ISO 13849 Design Guide for Machinery Safety Control Systems

In modern industrial environments, the importance of machinery safety control systems is self-evident. Whether it’s presses, printing machines, or emerging battery management systems (BMS), reliable safety control measures are essential to protect personnel and equipment. As the core international standard for safety-related parts of control systems, ISO 13849 provides designers and assessors with a systematic methodology.

This article will provide an in-depth interpretation of the basic framework and core concepts of the ISO 13849-1:2023 standard, helping readers build a comprehensive understanding of functional safety in machinery control systems.

Standard Positioning and Development History

Position of ISO 13849 in the Standard System

In the machinery safety standard system, ISO 13849-1 occupies an important position as a Type B1 general standard. Understanding its positioning in the entire standard hierarchy helps us correctly apply this standard:

flowchart TD
    A[Type A Basic Standards<br/>ISO 12100:2010<br/>Basic principles for machinery safety design<br/>Risk assessment and risk reduction] --> B[Type B General Standards]
    B --> C[Type B1: Safety Aspect Standards]
    B --> D[Type B2: Safety Device Standards]

    C --> C1[ISO 13849-1<br/>Safety-related control systems]
    C --> C2[IEC 62061<br/>E/E/PE functional safety]
    C --> C3[ISO 13857<br/>Safety distances]

    D --> D1[ISO 14119<br/>Interlocking devices]
    D --> D2[ISO 13851<br/>Two-hand control]
    D --> D3[ISO 13855<br/>Positioning of protective equipment]

    C --> E[Type C Product Standards<br/>Specific machine safety requirements<br/>e.g.: ISO 12622 Presses]

    style A fill:#e1f5ff
    style C1 fill:#ffe1e1,stroke:#ff0000,stroke-width:3px

The unique value of ISO 13849-1 lies in its technology-agnostic nature—it applies not only to electrical/electronic/programmable electronic systems but also covers hydraulic, pneumatic, and mechanical technologies. This broad applicability makes it the preferred standard for approximately 90% of machinery safety applications (2012 survey data).

Evolution from EN 954-1 to ISO 13849-1:2023

The development history of the standard reflects the technical progress of functional safety concepts:

Version	Year	Key Features
EN 954-1	1996	Pure deterministic approach, category-based architecture requirements
ISO 13849-1:2006	2006	Introduced Performance Level (PL) concept, combined probabilistic methods
ISO 13849-1:2015	2015	Improved software requirements, added more examples
ISO 13849-1:2023	2023	Reorganized structure, added appendices for EMI, software design, etc.

Key Evolution: From Deterministic to Probabilistic Methods

EN 954-1 used a purely deterministic category approach. While simple and intuitive, it couldn’t differentiate the actual safety performance differences between systems using components of different quality. The revolutionary Performance Level (PL) concept introduced by ISO 13849-1:2006 combines architectural requirements (Category) with probabilistic methods (MTTFd, DC, CCF), achieving a more comprehensive safety integrity assessment.

Core Concepts: SRP/CS and Safety Functions

Safety-Related Parts of Control Systems (SRP/CS)

SRP/CS (Safety-Related Part of a Control System) is the core subject of ISO 13849, defined as:

The part of a control system that performs safety functions, from safety-related input to the generation of safety-related output.

Understanding SRP/CS requires grasping three key points:

1. Meaning of “safety-related”: Refers to parts that have a direct impact on the execution of safety functions, whose failure could lead to safety function failure

2. Boundary nature of “part”: SRP/CS could be the entire control system or just a part of it, depending on whether it performs safety functions

3. Technology independence: Can be electrical/electronic/programmable electronic, hydraulic, pneumatic, mechanical, or a combination thereof

flowchart LR
    subgraph 输入端[Input Boundary]
        A[Actuating mechanism<br/>e.g., cam, roller]
        B[Sensor<br/>position switch, light curtain]
        C[Connection cable]
    end

    subgraph 逻辑端[Logic Boundary]
        D[Signal processing]
        E[Judgment logic]
        F[Control output]
    end

    subgraph 输出端[Output Boundary]
        G[Power control element<br/>contactor main contacts]
        H[Actuator interface]
    end

    A --> D
    B --> D
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H

    style A fill:#e1f5ff
    style B fill:#e1f5ff
    style C fill:#e1f5ff
    style D fill:#fff4e1
    style E fill:#fff4e1
    style F fill:#fff4e1
    style G fill:#e8f5e9
    style H fill:#e8f5e9

Practical significance of SRP/CS boundary determination:

Boundary Position	Contents Included	Typical Examples
Input boundary	Actuating mechanisms, sensors, connection cables	Position switch cams, rollers, contacts, wiring
Logic boundary	Signal processing, judgment, output control	PLCs, safety relays, valve control circuits
Output boundary	Main contacts of power switching elements	Contactor main contacts, solenoid valve spools

Safety Function

Safety function is another core concept of ISO 13849:

A function of a machine whose failure can lead to an immediate increase in risk.

Key understanding points:

1. Meaning of “immediate increase”: After safety function failure, the machine directly enters a dangerous state without requiring other conditions

2. Distinction from operational functions:

   • Operational function failure → Machine cannot work normally, but does not increase risk
   • Safety function failure → Risk increases immediately

3. Dual identity: A function may be both an operational function and a safety function (e.g., certain speed monitoring functions)

Typical Safety Function Types

ISO 13849-1 lists typical safety function types in clause 5.2.2:

Safety Function Type	English Description	Typical Application Scenarios
Stop function	Stopping function	Emergency stop, guard interlock stop
Safety speed monitoring	Safely limited speed	Low-speed operation in maintenance mode
Safety torque monitoring	Safely limited torque	Preventing pinching injuries
Safety position monitoring	Safely limited position	Limiting range of motion
Safe direction	Safe direction	Only allowing motion in safe direction
Prevention of unexpected startup	Prevention of unexpected start	Protection during maintenance
Enabling function	Enabling function	Hold-to-run switch must be continuously pressed
Two-hand control	Two-hand control	Requires simultaneous two-hand operation
Re-start interlock	Re-start interlock	Can only restart after conditions are met

Risk Assessment and Performance Level Determination

Risk Assessment Process (ISO 12100)

Risk assessment is the starting point for applying ISO 13849, following the methodology of ISO 12100:2010:

flowchart TD
    A[Machine limit determination<br/>Define usage scope, environmental conditions, expected life] --> B[Hazard identification<br/>Identify all possible hazard sources]
    B --> C[Risk estimation<br/>Assess injury severity and probability of occurrence]
    C --> D[Risk evaluation<br/>Determine if risk is acceptable]

    D --> E{Is risk acceptable?}

    E -->|Yes| F[Complete]
    E -->|No| G[Risk reduction measures<br/>Inherently safe design → Safeguards → Use information]
    G --> C

    style A fill:#e3f2fd
    style B fill:#fff3e0
    style C fill:#f3e5f5
    style D fill:#ffebee
    style G fill:#e8f5e9

Three-Step Risk Reduction Method

ISO 12100 specifies the three-step risk reduction principle, which must be applied in order:

Step	Measure Type	Description	Examples
Step 1	Inherently safe design	Eliminate or reduce risk through design	Reduce motion speed, eliminate sharp edges, use low voltage
Step 2	Safeguarding and/or complementary protective measures	Take protective measures against risks that cannot be eliminated	Interlocking guards, emergency stop devices, two-hand control
Step 3	Use information	Inform users of residual risks	Warning signs, operation manuals, training requirements

Important principle: Measures from later steps cannot compensate for deficiencies in earlier steps. For example, warning signs cannot substitute for guards that should be installed.

Role of SRP/CS in Risk Reduction

When Step 2 (safeguarding and complementary protective measures) requires control system participation to implement safety functions, it involves the design of SRP/CS:

flowchart TD
    A[Initial risk] --> B[Step 1: Inherently safe design<br/>Reduce inherent risk]
    B --> C[Step 2: Safeguarding/complementary protective measures]

    C --> D{Does it require<br/>control system participation?}

    D -->|Yes| E[SRP/CS implements safety functions<br/>ISO 13849-1 applicable scope]
    D -->|No| F[Physical protective measures<br/>e.g., guards]

    E --> G[Step 3: Use information<br/>Warning signs, operation manuals]
    F --> G

    G --> H[Residual risk acceptable]

    style E fill:#e1f5ff
    style E stroke:#2196f3,stroke-width:3px

Performance Level (PL) and Required Performance Level (PLr)

Performance Level (PL) is the core safety integrity measure in ISO 13849:

• PL range: From PL a (lowest) to PL e (highest), 5 discrete levels total
• Metric: Based on Probability of dangerous Failure per Hour (PFH)
• Determining factors: Category, MTTFd, DCavg, CCF

Required Performance Level (PLr) is the target value determined through risk assessment, indicating how high the safety integrity needs to be to achieve the required risk reduction.

PFH Range (dangerous failures per hour)	ISO 13849-1	IEC 62061
≥10⁻⁵ to <10⁻⁴	PL a	-
≥3×10⁻⁶ to <10⁻⁵	PL b	SIL 1
≥10⁻⁶ to <3×10⁻⁶	PL c	SIL 1
≥10⁻⁷ to <10⁻⁶	PL d	SIL 2
≥10⁻⁸ to <10⁻⁷	PL e	SIL 3

Design objective: Actually achieved PL ≥ Required PLr

Functional Structure and Subsystems of SRP/CS

Three Functional Modules of SRP/CS

ISO 13849-1 uses the concept of Block to describe the functional structure of SRP/CS:

flowchart LR
    subgraph safety-function[Safety Function]
        I[I Input<br/>Input<br/>Detect safety-related states]
        L[L Logic<br/>Logic<br/>Process signals, make decisions]
        O[O Output<br/>Output<br/>Execute safety actions]

        I --> L
        L --> O

        I -.Test/Monitor.-> T
        L -.Test/Monitor.-> T
        O -.Test/Monitor.-> T

        T[Test/Monitoring<br/>Test/Monitoring<br/>Applicable to Category 2, 3, 4]
    end

    style I fill:#e3f2fd
    style L fill:#fff3e0
    style O fill:#e8f5e9
    style T fill:#fce4ec,stroke-dasharray: 5 5

Three functional modules explained:

Module	English	Function	Typical Components
Input	Input (I)	Detect safety-related states	Position switches, light curtains, emergency stop buttons, pressure sensors
Logic	Logic (L)	Process signals, make decisions	PLCs, safety relays, control circuits
Output	Output (O)	Execute safety actions	Contactors, solenoid valves, motor drives

Subsystem Concept

Subsystem is an independent unit within SRP/CS used to simplify analysis, with clear boundaries and independently assessable performance levels.

Subsystem division principles:

1. Functional completeness: Each subsystem should be able to complete an independent function
2. Clear boundaries: Interfaces between subsystems should be clearly defined
3. Assessability: Each subsystem’s PL can be independently assessed

flowchart TD
    subgraph complete-safety-function[Complete Safety Function]
        subgraph S1[Subsystem 1: Light curtain sensor]
            direction TB
            S1a[Transmitter]
            S1b[Receiver]
            S1c[Signal processing]
        end

        subgraph S2[Subsystem 2: Safety PLC]
            direction TB
            S2a[Input module]
            S2b[Logic processing]
            S2c[Output module]
        end

        subgraph S3[Subsystem 3: Contactor]
            direction TB
            S3a[Coil]
            S3b[Main contacts]
        end

        S1 -->|PL=d| S2
        S2 -->|PL=e| S3
        S3 -.PL=c.-> S4[Overall PL = ? Need calculation]
    end

    style S1 fill:#e1f5ff
    style S2 fill:#fff4e1
    style S3 fill:#e8f5e9

Category Architecture

ISO 13849-1 defines 5 categories (B, 1, 2, 3, 4), describing the classification of subsystems in terms of fault resistance and subsequent behavior under fault conditions:

flowchart TD
    subgraph category-system[Category System]
        B[Category B<br/>Basic safety principles<br/>No fault tolerance]
        C1[Category 1<br/>Proven components<br/>High reliability]
        C2[Category 2<br/>Automatic detection<br/>Periodic testing]
        C3[Category 3<br/>Single fault tolerance<br/>High diagnostic coverage]
        C4[Category 4<br/>Multiple fault tolerance<br/>Very high diagnostic coverage]
    end

    B --> C1
    C1 --> C2
    C2 --> C3
    C3 --> C4

    style B fill:#ffebee
    style C1 fill:#fff3e0
    style C2 fill:#e8f5e9
    style C3 fill:#e3f2fd
    style C4 fill:#f3e5f5

Category Comparison

Category	Architecture Features	Fault Behavior	MTTFd Requirements	DCavg Requirements	Applicable PL Range
B	Basic safety principles	May lead to safety function failure	Low to medium	None	PL a-b
1	Proven components	High reliability, but function fails after fault	High	None	PL b-c
2	Automatic detection	Detects faults through testing	Medium to high	Low to medium	PL b-d
3	Single fault tolerance	Single fault does not lead to safety function failure	Low to high	Medium to high	PL c-e
4	Multiple fault tolerance	Accumulated faults do not lead to safety function failure	High	High	PL e

Category selection guide:

• Category B/1: Suitable for low-risk applications (PL a-b)
• Category 2: Suitable for medium-risk applications requiring periodic detection (PL b-d)
• Category 3: Suitable for high-risk applications requiring single fault tolerance (PL c-e)
• Category 4: Suitable for very high-risk applications requiring multiple fault tolerance (PL e)

Key Reliability Parameters

MTTFd (Mean Time To Dangerous Failure)

MTTFd (Mean Time To Dangerous Failure) is the expected value of the average time to dangerous failure, used to measure component reliability:

MTTFd Level	Range (years)	Typical Applications
Low	3 ≤ MTTFd < 10	Simple mechanical components
Medium	10 ≤ MTTFd < 30	General industrial components
High	30 ≤ MTTFd < 100	High-quality industrial components
Very high	MTTFd ≥ 100	Special high-reliability components

DCavg (Diagnostic Coverage Average)

DC (Diagnostic Coverage) is the ratio of detected dangerous failure rate to total dangerous failure rate:

DCavg Level	Coverage Range	Detection Capability
None	DC < 60%	Almost no detection
Low	60% ≤ DC < 90%	Detect most failures
Medium	90% ≤ DC < 99%	Detect almost all failures
High	DC ≥ 99%	Detect all known failures

CCF (Common Cause Failure)

CCF (Common Cause Failure) is the simultaneous failure of multiple channels in a multi-channel subsystem caused by one or more events. ISO 13849-1 Annex F provides a CCF protection measure scoring table, requiring at least 65 points (out of 100).

Typical CCF protection measures:

Measure	Score	Description
Separation/isolation	15	Physical separation, electrical isolation, barriers
Diversity	20	Different technologies, different design principles
Assessment/analysis	20	FMEA, FTA, etc.
Training/procedures	15	Personnel training, maintenance procedures
Environmental control	10	Temperature, humidity, vibration control
Functional safety capability	20	Safety management, capability assessment

Practical Application Case: BMS Safety Function

Case Background

Industrial Battery Management Systems (BMS) are used for safety monitoring of lithium battery packs, representing an important application of ISO 13849 in the new energy field.

Hazard Analysis

ID	Hazard	Possible Causes	Possible Harm
H1	Battery overcharge	Charging control failure, voltage detection error	Thermal runaway, fire, explosion
H2	Battery over-discharge	Discharge control failure, SOC calculation error	Battery damage, potential fire risk
H3	Over-temperature	Cooling failure, temperature detection error	Thermal runaway, fire
H4	Over-current	Short circuit, load abnormality	Equipment damage, fire
H5	Insulation failure	Insulation aging, moisture	Electric shock

Safety Function Definition

SF ID	Safety Function	Trigger Condition	Response Behavior	Estimated PLr
SF1	Overvoltage protection	Cell voltage > 4.2V	Cut off charging circuit	PL d
SF2	Undervoltage protection	Cell voltage < 2.5V	Cut off discharge circuit	PL c
SF3	Over-temperature protection	Cell temperature > 60°C	Cut off charge/discharge circuits	PL d
SF4	Over-current protection	Current > 1.5× rated value	Cut off circuit	PL d
SF5	Insulation monitoring	Insulation resistance < 100Ω/V	Alarm and cut off	PL c

SRP/CS Boundary Definition

flowchart LR
    subgraph input-subsystem[Input Subsystem]
        V[Voltage sensor]
        T[Temperature sensor]
        C[Current sensor]
        I[Insulation monitoring]
    end

    subgraph logic-subsystem[Logic Subsystem]
        MCU[Safety MCU<br/>MPC5744P]
        ALGO[Protection algorithm]
    end

    subgraph output-subsystem[Output Subsystem]
        MOS[MOSFET switch]
        CONT[Contactor]
        ALM[Alarm output]
    end

    V --> MCU
    T --> MCU
    C --> MCU
    I --> MCU

    MCU --> ALGO
    ALGO --> MOS
    ALGO --> CONT
    ALGO --> ALM

    style MCU fill:#fff4e1,stroke:#ff9800,stroke-width:3px

Design Implementation Points

1. Input subsystem:

   • Use sensors with proven safety principles
   • Sampling rate meets response time requirements
   • Signal filtering and validation

2. Logic subsystem:

   • Use safety MCU (e.g., MPC5744P, compliant with ISO 26262 ASIL-D)
   • Independent watchdog and clock monitoring
   • Program integrity verification (CRC)

3. Output subsystem:

   • Dual-channel MOSFET configuration (Category 3 or 4)
   • Feedback loop verifies output status
   • Fail-safe design

4. System-level protection:

   • EMI/EMC protection (ISO 13849-1:2023 Annex J)
   • Environmental adaptability design
   • Maintenance and fault diagnosis interfaces

Selection Between ISO 13849 and IEC 62061

Both standards are general standards for functional safety of machinery control functions. Consider the following factors when choosing:

Comparison Dimension	ISO 13849-1	IEC 62061
Technical scope	Electrical/electronic/programmable electronic, hydraulic, pneumatic, mechanical	Only electrical/electronic/programmable electronic
Safety level	Performance Level PL a-e	Safety Integrity Level SIL 1-3
Architecture approach	Specified architecture (Category B-4)	Safety Integrity Level requirements
Applicable scenarios	Simple to complex systems	Complex programmable electronic systems
Market usage	Approximately 90% (2012 survey)	Approximately 10%
Complexity	Relatively simple, more intuitive	More complex, requires more expertise

Selection recommendations:

1. Prefer ISO 13849-1 when:

   • Involving multiple technologies (hydraulic, pneumatic, etc.)
   • System is relatively simple
   • Team is more familiar with deterministic methods
   • Need rapid assessment and verification

2. Consider IEC 62061 when:

   • Pure electrical/electronic systems
   • Complex programmable electronic systems
   • Already have IEC 61508 background
   • Need more refined probabilistic analysis

Implementation Checklist

Safety Function Identification Checklist

┌─────────────────────────────────────────────────────────────────┐
│                    Safety Function Identification Checklist      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. Machine Limit Determination                                 │
│     □ Usage limitations (who uses, how used, skill level)       │
│     □ Spatial limitations (range of motion, installation location)│
│     □ Time limitations (expected life, maintenance cycle)        │
│     □ Environmental conditions (temperature, humidity, dust)     │
│                                                                 │
│  2. Hazard Identification                                       │
│     □ Mechanical hazards (crushing, shearing, cutting, entanglement, etc.)│
│     □ Electrical hazards (electric shock, static electricity)    │
│     □ Thermal hazards (high temperature, low temperature)        │
│     □ Other hazards (noise, vibration, radiation)               │
│                                                                 │
│  3. Safety Function Determination                               │
│     For each hazard:                                            │
│     □ Does this hazard require safety control measures?          │
│     □ Do safety control measures require SRP/CS?                │
│     □ If yes, define specific safety functions                  │
│                                                                 │
│  4. Safety Function Characteristics                             │
│     For each safety function:                                   │
│     □ Function description (what it does)                       │
│     □ Trigger conditions (when activated)                       │
│     □ Response behavior (what action to execute)                │
│     □ Response time requirements                                │
│     □ Reset requirements                                        │
│     □ Interface definition                                      │
│                                                                 │
│  5. PLr Determination                                           │
│     □ Use risk graph to determine PLr                           │
│     □ Or reference relevant Type C standards                    │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

SRP/CS Design Checklist

┌─────────────────────────────────────────────────────────────────┐
│                    SRP/CS Design Checklist                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. Architecture Design                                         │
│     □ Select appropriate category (B, 1, 2, 3, 4)               │
│     □ Determine subsystem division                              │
│     □ Define subsystem boundaries                               │
│     □ Design interfaces between subsystems                      │
│                                                                 │
│  2. Component Selection                                         │
│     □ Use proven components                                     │
│     □ Determine MTTFd level                                     │
│     □ Obtain reliability data                                   │
│     □ Assess environmental adaptability                         │
│                                                                 │
│  3. Diagnostic Design                                           │
│     □ Design diagnostic tests                                   │
│     □ Calculate DCavg                                           │
│     □ Define test intervals                                    │
│     □ Design fault indication                                   │
│                                                                 │
│  4. CCF Protection                                              │
│     □ Implement separation/isolation                            │
│     □ Use diverse design                                        │
│     □ Complete CCF scoring (≥65 points)                        │
│                                                                 │
│  5. Verification                                                │
│     □ Verify calculated PL ≥ PLr                                │
│     □ Complete fault analysis                                   │
│     □ Perform verification tests                                │
│     □ Prepare verification report                               │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Frequently Asked Questions (FAQ)

Q1: What’s the difference between SRP/CS and ordinary control systems?

A: SRP/CS is the part of the control system that performs safety functions, while ordinary control systems perform operational functions. The key difference is:

• Safety functions: Failure leads to immediate increase in risk
• Operational functions: Failure only affects normal machine operation, does not increase risk

The same control system may contain both safety-related and operation-related parts. Only the safety-related parts need to be designed and assessed according to ISO 13849.

Q2: How to determine if a function is a safety function?

A: Use the following judgment process:

1. Will the machine enter a dangerous state if this function fails?
2. Is this function needed to maintain risk at an acceptable level?
3. Does the risk increase immediately if this function fails?

If the answers to all these questions are “yes,” then the function is a safety function.

Q3: When is ISO 13849 needed?

A: ISO 13849 is needed when the following conditions are met:

1. Machine requires risk assessment (ISO 12100)
2. Risk assessment determines need for safety control measures
3. Safety control measures are implemented by control systems (i.e., need SRP/CS)
4. Operating mode is high demand mode or continuous mode

Q4: What’s the relationship between ISO 13849-1 and ISO 13849-2?

A:

• ISO 13849-1:2023 - Design part, specifies design requirements and assessment methods for SRP/CS
• ISO 13849-2:2012 - Validation part, specifies validation methods and procedures for SRP/CS

After design completion, validation must be performed according to ISO 13849-2 to confirm the design meets requirements. Notably, Chapter 10 of ISO 13849-1:2023 already includes core validation requirements, but detailed fault lists and validation methods still need to reference the annexes of ISO 13849-2.

Q5: What’s the difference between PL and PLr?

A:

• PLr (Required PL): Required Performance Level, a target value determined through risk assessment, indicating how high the safety integrity needs to be to achieve the required risk reduction
• PL (Performance Level): Performance Level, the safety integrity level actually achieved by the SRP/CS

The design objective is: Actually achieved PL ≥ Required PLr

Q6: How to distinguish between low demand mode and high demand mode?

A:

• High demand mode/continuous mode: Safety function demand frequency greater than once per year
• Low demand mode: Safety function demand frequency not exceeding once per year

ISO 13849 only applies to high demand mode and continuous mode. For low demand mode, the IEC 61508 series standards should be used, with PFD (Probability of Failure on Demand) as the metric instead of PFH.

Summary of Key Points

1. ISO 13849 is comprehensive: Covers multiple technology types, from simple to complex systems
2. PL is the core metric: Comprehensively determined through four dimensions: Category, MTTFd, DCavg, CCF
3. Risk assessment is the starting point: PLr must be determined based on system risk assessment
4. SRP/CS boundaries are clear: Complete control chain from safety-related input to safety-related output
5. Verification is essential: After design completion, validation must be performed according to ISO 13849-2

Next Steps

Understanding the basic framework of ISO 13849 is just the first step. In upcoming articles, we will delve deeper into:

• Detailed calculation methods for Performance Levels (PL)
• Specific implementation architectures for each category
• Determination and calculation of key parameters (MTTFd, DCavg, CCF)
• Practical design examples and best practices
• Specific methods for validation and confirmation

---

This article outlines the basic framework and core concepts of ISO 13849-1:2023. For specific guidance on your product or system, please consult functional safety certification experts.