ISO 13849 Performance Level (PL) Explained: Complete Guide from PLa to PLe

Executive Summary

Performance Level (PL) is the core metric in ISO 13849-1 standard for measuring the safety integrity of safety-related control systems (SRP/CS). This article comprehensively analyzes the PL concept framework, including the relationship between PL and PFH values, technical requirements for five categories (Category B/1/2/3/4), risk graph usage methods, and how to design safety control systems that meet standard requirements through the PLr (Required Performance Level) determination process.

For mechanical safety engineers, functional safety practitioners, and equipment manufacturers, deep understanding of the PL framework is the foundation for ensuring products comply with ISO 13849 standard requirements. This article combines practical application cases, especially battery management system (BMS) application examples, to help readers establish a complete PL knowledge framework.

---

I. Core Concepts of Performance Level (PL)

1.1 Definition and Technical Meaning of PL

Performance Level (PL) is a discrete level used in ISO 13849-1 standard to specify the capability of safety-related parts to perform safety functions under foreseeable conditions.

Technically, PL is a quantitative description of safety function reliability. The standard defines each PL level through the metric Probability of dangerous Failure per Hour (PFH). PFH originates from the IEC 61508 series of standards and is a universally applicable safety integrity measure in the field of functional safety.

1.2 Correspondence Between PL and PFH

ISO 13849-1 defines five performance levels from PL a to PL e, each corresponding to a specific PFH value range:

PL Level	PFH Range	Safety Integrity	Expected Failure Interval	Application Scenarios
PL a	≥10⁻⁵ to <10⁻⁴	Lowest	Average failure every 11.4 years	Non-critical safety functions
PL b	≥3×10⁻⁶ to <10⁻⁵	Lower	Average failure every 38 years	Low risk control
PL c	≥10⁻⁶ to <3×10⁻⁶	Medium	Average failure every 114 years	Medium risk control
PL d	≥10⁻⁷ to <10⁻⁶	Higher	Average failure every 1,141 years	High risk control
PL e	≥10⁻⁸ to <10⁻⁷	Highest	Average failure every 11,415 years	Very high risk control

graph LR
    subgraph "PL Level vs PFH Correspondence (Increasing Safety Integrity)"
        A[PL a<br/>10⁻⁵≤PFH<10⁻⁴<br/>Lowest Integrity] --> B[PL b<br/>3×10⁻⁶≤PFH<10⁻⁵<br/>Lower Integrity]
        B --> C[PL c<br/>10⁻⁶≤PFH<3×10⁻⁶<br/>Medium Integrity]
        C --> D[PL d<br/>10⁻⁷≤PFH<10⁻⁶<br/>Higher Integrity]
        D --> E[PL e<br/>10⁻⁸≤PFH<10⁻⁷<br/>Highest Integrity]
    end

    style A fill:#ffebee
    style B fill:#fff3e0
    style C fill:#fff9c4
    style D fill:#e8f5e9
    style E fill:#c8e6c9

Key Technical Understanding:

PFH represents the average probability of dangerous failure of the safety function per hour. Its calculation relationship is:

PFH = λD × (1 - DC) × Other correction factors

Where:
- λD = Dangerous failure rate (= 1/MTTFd)
- DC = Diagnostic Coverage

The smaller the PFH value, the lower the probability of dangerous failure of the safety function, and the higher the safety integrity. From PL a to PL e, as the level increases, reliability requirements grow exponentially. For example, PL e requirements are more than 1000 times stricter than PL a.

1.3 Determinants of PL

ISO 13849-1 defines three main factors that determine the achieved PL:

graph TD
    A[Achieved PL] --> B[Category]
    A --> C[MTTFd<br/>Mean Time to Dangerous Failure]
    A --> D[DCavg<br/>Average Diagnostic Coverage]

    B --> E[Architecture Requirements<br/>B/1/2/3/4]
    C --> F[Component Reliability<br/>Low/Medium/High]
    D --> G[Fault Detection Capability<br/>None/Low/Medium/High]

    A --> H[CCF<br/>Common Cause Failure<br/>Only for Category 2/3/4]

    style A fill:#e3f2fd
    style B fill:#bbdefb
    style C fill:#bbdefb
    style D fill:#bbdefb
    style H fill:#90caf9

Mechanism of Each Factor:

Factor	Full Name	Technical Function	Design Impact
Category	Category	Defines fault tolerance of architecture	Determines system architecture design
MTTFd	Mean Time to Dangerous Failure	Defines component reliability	Affects component selection
DCavg	Average Diagnostic Coverage	Defines fault detection capability	Determines diagnostic mechanism design
CCF	Common Cause Failure	Independence of multi-channel systems	Affects redundancy design diversity

---

II. Determination Method for Required Performance Level (PLr)

2.1 Definition and Importance of PLr

Required Performance Level (PLr) is the performance level required to achieve the risk reduction for each safety function.

Core Concept Understanding:

1. PLr is a design target: Determined through risk assessment, not arbitrarily chosen
2. Verification principle: Actual achieved PL must ≥ PLr (PL ≥ PLr)
3. Functional independence: Each safety function needs separate PLr determination

2.2 PLr Determination Methods

ISO 13849-1 provides two methods for determining PLr:

Method	Application Scenario	Standard Source	Priority
Type C Standard	Specific machine types	Specified in product standards	High
Risk Graph	General method	ISO 13849-1 Annex A	Low

Recommended Determination Process:

graph TD
    A[Start PLr Determination] --> B{Is there an applicable Type C Standard?}
    B -->|Yes| C[Consult Type C Standard]
    B -->|No| D[Use Risk Graph]
    C --> E{Does standard explicitly specify PLr?}
    E -->|Yes| F[Use standard-specified PLr directly]
    E -->|No| D
    D --> G[Evaluate S/F/P Parameters]
    G --> H[Check table to determine PLr]
    F --> I[Complete PLr Determination]
    H --> I

    style A fill:#e8f5e9
    style I fill:#c8e6c9
    style F fill:#a5d6a7
    style H fill:#a5d6a7

Implementation Recommendations:

1. Check Type C Standards first: Many machine types have dedicated Type C standards (e.g., ISO 10218 for robots, ISO 16092 for presses, etc.)
2. Prioritize standard specifications: If Type C standard explicitly specifies PLr, adopt it directly
3. Risk graph as backup: Only use risk graph when no applicable Type C standard exists

2.3 Correspondence Between Safety Functions and PLr

A machine control system typically includes multiple safety functions, each potentially corresponding to different PLr requirements:

Safety Function	Typical Application	PLr Range	Risk Characteristics
Emergency Stop	All machinery	c-d	Serious consequences, frequent use
Safety Door Interlock	Guards	d-e	High severity, unavoidable risk
Speed/Position Monitoring	Motion control	c-d	Mechanical injury risk
Temperature/Pressure Monitoring	Process control	b-c	Equipment damage risk
Manual Reset	System restart	b-c	Misoperation risk

---

III. Risk Graph Detailed Explanation and Usage

3.1 Risk Graph Structure

The risk graph provided in ISO 13849-1 Annex A determines PLr through three risk parameters:

graph TD
    A[Risk Assessment] --> B[Severity S<br/>S1/S2]
    B --> C[Frequency/Exposure F<br/>F1/F2]
    C --> D[Possibility of Avoidance P<br/>P1/P2]
    D --> E[PLr Determination<br/>a/b/c/d/e]

    style A fill:#e3f2fd
    style B fill:#bbdefb
    style C fill:#bbdefb
    style D fill:#bbdefb
    style E fill:#90caf9

3.2 Detailed Risk Parameters

3.2.1 Severity (S)

Parameter	Description	Judgment Criteria	Typical Cases
S1	Slight injury	Reversible injury, usually fully recoverable	Minor scratches, bruises, abrasions
S2	Serious injury/Death	Irreversible injury, permanent consequences	Death, amputation, permanent disability

S Parameter Judgment Points:

• Consider the most severe reasonably foreseeable consequence
• If injury could be fatal, must select S2
• When uncertain, tend to select S2
• Do not consider rare multiple fault combinations

BMS Application Example:

Hazard Scenario	Possible Consequence	S Parameter	Judgment Basis
Battery overcharge thermal runaway	Fire, explosion, possible death	S2	Life safety risk
Insulation failure (low voltage <60V)	Electric shock, mild shock	S1	Reversible injury
Insulation failure (high voltage >60V)	Electric shock, possible death	S2	Life safety risk
Battery over-discharge	Capacity loss, economic loss	S1	No personal injury

3.2.2 Frequency/Exposure (F)

Parameter	Description	Judgment Criteria	Typical Scenarios
F1	Rare exposure	Exposure time less than 15 minutes per day, or frequency less than once per 15 minutes	Maintenance operations, occasional entry
F2	Frequent exposure	Exposure time more than 15 minutes per day, or frequency more than once per 15 minutes	Normal operation, continuous monitoring

F Parameter Judgment Process:

graph TD
    A[Evaluate Exposure Frequency] --> B{Does personnel need to<br/>enter hazard zone?}
    B -->|No| C{Is there other<br/>exposure means?}
    B -->|Yes| D[Evaluate entry frequency and time]
    C -->|Material/product exposure| E{How is exposure frequency?}
    C -->|No exposure| F[F1]
    D --> G{<15 min/day?}
    E -->|Rare| F
    E -->|Frequent| H[F2]
    G -->|Yes| F
    G -->|No| H

    style A fill:#e3f2fd
    style F fill:#c8e6c9
    style H fill:#ffcdd2

F Parameter Judgment Points:

• Consider all operation modes (normal operation, maintenance, setup, cleaning, etc.)
• If any operation mode requires frequent entry into hazard zone, select F2
• Continuously running equipment usually selects F2
• Consider not only personnel entry but also material/product exposure

3.2.3 Possibility of Avoidance (P)

Parameter	Description	Judgment Criteria	Typical Scenarios
P1	Possible to avoid	Can be avoided under specific conditions	Obvious warning, sufficient reaction time
P2	Almost impossible to avoid	Cannot be avoided under reasonably foreseeable conditions	Sudden events, high-speed movement, no warning

Key Factors Affecting P Selection:

Factor	Tend to P1	Tend to P2
Is hazard obvious?	Obviously identifiable	Hidden or difficult to identify
Is there warning?	Audible/visual warning	No warning
Reaction time	Sufficient (>1 second)	Insufficient (<1 second)
Escape path	Safe area exists	No escape possible
Operator experience	Well trained	Inexperienced or temporary workers
Movement speed	Low-speed movement	High-speed or sudden movement
Hazard nature	Gradual change	Sudden occurrence

Special Case Handling:

The standard allows considering the “probability of occurrence of hazardous event” parameter when the probability is truly negligible (e.g., multiple independent faults need to occur simultaneously). However, in most practical applications, assume the hazardous event will occur and do not use this parameter for downgrading.

3.3 Risk Graph Table Lookup Method

Based on the combination of S, F, P parameters, directly check the table to determine PLr:

S	F	P	PLr	Risk Level
S1	F1	P1	a	Lowest risk
S1	F1	P2	b	Low risk
S1	F2	P1	b	Low risk
S1	F2	P2	c	Medium-low risk
S2	F1	P1	c	Medium risk
S2	F1	P2	d	Medium-high risk
S2	F2	P1	d	Medium-high risk
S2	F2	P2	e	Highest risk

PLr Determination Logic Memory Tips:

Basic Rules:
- Lightest risk (S1+F1+P1) → PLr a
- Heaviest risk (S2+F2+P2) → PLr e

Parameter Impact:
- S2 adds 2 levels (a→c, b→d, c→e)
- F2 adds 1 level (a→b, b→c, c→d, d→e)
- P2 adds 1 level (a→b, b→c, c→d, d→e)

Example Calculation:
S1 + F1 + P1 = a (starting point)
S2 + F1 + P1 = a + 2 = c
S2 + F2 + P1 = c + 1 = d
S2 + F2 + P2 = d + 1 = e

graph TD
    subgraph "Risk Graph Lookup Schematic"
        A[S1] --> B[F1 Combinations]
        A --> C[F2 Combinations]
        D[S2] --> E[F1 Combinations]
        D --> G[F2 Combinations]

        B --> H[P1: PL a]
        B --> I[P2: PL b]
        C --> J[P1: PL b]
        C --> K[P2: PL c]
        E --> L[P1: PL c]
        E --> M[P2: PL d]
        G --> N[P1: PL d]
        G --> O[P2: PL e]

        style H fill:#c8e6c9
        style I fill:#a5d6a7
        style J fill:#a5d6a7
        style K fill:#81c784
        style L fill:#81c784
        style M fill:#66bb6a
        style N fill:#66bb6a
        style O fill:#4caf50
    end

---

IV. Detailed Explanation of Categories

4.1 Definition and Technical Meaning of Category

Category is the classification of subsystems in terms of fault tolerance and subsequent behavior under fault conditions, achieved through structural arrangement of parts, fault detection, and/or their reliability.

Technical Meaning:

• Category defines the architecture requirements of SRP/CS
• Different categories correspond to different fault tolerance capabilities
• Category is the architectural foundation for achieving specific PL
• Each category has a specified architecture defined by the standard

4.2 Comprehensive Comparison of Five Categories

Feature	Cat B	Cat 1	Cat 2	Cat 3	Cat 4
Main Characteristic	Basic requirement	Proven components	Periodic testing	Single fault tolerance	Cumulative fault tolerance
Fault Detection	None	None	Yes	Yes	Yes
Fault Tolerance	None	None	None	Single fault	Cumulative fault
MTTFd Requirement	Low-Medium	High	Low-High	Low-High	High
DC Requirement	None	None	Low-Medium	Low-Medium	High (>99%)
CCF Requirement	None	None	Yes (≥65 points)	Yes (≥65 points)	Yes (≥65 points)
Achievable PL Range	a-b	c	a-d	a-e	a-e
Typical Application	Non-critical functions	Traditional components	Medium risk	Higher risk	High risk
Cost Level	Low	Low	Medium	High	High
Implementation Difficulty	★	★★	★★★	★★★★	★★★★★

4.3 Category B Detailed Explanation

Definition: The lowest requirement category designed based on basic safety principles.

Technical Requirements:

Requirement Item	Specific Content	Verification Method
Basic safety principles	Must be followed (e.g., proper derating design, environmental protection)	Design review
MTTFd	Low to medium (specific values affect PL)	Calculation/table lookup
DC	No requirement	N/A
CCF	No requirement	N/A
Fault behavior	Fault leads to loss of safety function	Fault analysis

Specified Architecture Diagram:

graph LR
    subgraph "Category B Architecture"
        I[Input I] --> L[Logic L]
        L --> O[Output O]
    end

    style I fill:#e3f2fd
    style L fill:#bbdefb
    style O fill:#90caf9

    note[Feature: Single channel, no diagnostics, fault means failure]

Applicable Scenarios:

• PLr requirement is low (a or b)
• Non-critical safety functions
• Cost-sensitive applications
• Simple indication or alarm functions

BMS Application Example:

• Low voltage indicator (non-safety critical)
• Simple monitoring of non-critical states
• Auxiliary status display

4.4 Category 1 Detailed Explanation

Definition: Category designed based on basic safety principles and proven safety principles/components.

Technical Requirements:

Requirement Item	Specific Content	Verification Method
Basic safety principles	Must be followed	Design review
Proven safety principles	Must be followed	Design review
Proven components	Must be used	Component evaluation
MTTFd	High (because proven components are used)	Calculation/table lookup
DC	No requirement	N/A
CCF	No requirement	N/A

Definition of Proven Components:

1. Extensive successful experience in similar applications (usually >5 years)
2. Or rigorously tested and evaluated to prove reliability
3. Includes proven mechanical, electrical, electronic components

Specified Architecture Diagram:

graph LR
    subgraph "Category 1 Architecture"
        I[Input I<br/>Proven] --> L[Logic L<br/>Proven]
        L --> O[Output O<br/>Proven]
    end

    style I fill:#fff3e0
    style L fill:#ffe0b2
    style O fill:#ffcc80

    note[Feature: Single channel, uses proven components, high reliability]

Applicable Scenarios:

• PLr requirement is c
• Traditional mechanical/electrical components can be used
• No fault diagnosis needed
• Mature components available

BMS Application Example:

• Overcurrent protection using proven relays
• Using mature safety relay modules
• Proven circuit breaker protection

4.5 Category 2 Detailed Explanation

Definition: Single-channel architecture with periodic testing to detect faults.

Technical Requirements:

Requirement Item	Specific Content	Verification Method
Basic safety principles	Must be followed	Design review
Proven safety principles	Must be followed	Design review
MTTFd	Low to high	Calculation/table lookup
DC	Low to medium (affects PL)	Diagnostic analysis
CCF	Measures needed (score ≥65)	CCF scoring
Test frequency	Must satisfy rt ≥ rd	Test verification
Fault behavior	Fault may affect function before next test	Fault analysis

Key Design Considerations:

1. Test Timing:

   • At machine startup (automatic test)
   • Periodic (e.g., every 8 hours, daily)
   • Before each safety function demand

2. Test Requirements:

   • Test coverage determines DC level
   • Test frequency must be sufficiently high
   • Test failure must lead to safe state
   • Test must not introduce new hazards

Specified Architecture Diagram:

graph LR
    subgraph "Category 2 Architecture"
        I[Input I] --> L[Logic L]
        L --> O[Output O]
        I --> TE[Test Equipment TE]
        L --> TE
        O --> TE
        TE --> OT[Test Output OT]
    end

    style I fill:#e3f2fd
    style L fill:#bbdefb
    style O fill:#90caf9
    style TE fill:#64b5f6
    style OT fill:#42a5f5

    note[Feature: Single channel + periodic testing, tests can detect faults]

Applicable Scenarios:

• PLr requirement is a to d
• Acceptable fault exposure time
• Balance between cost and performance
• Can implement periodic self-test

BMS Application Example:

• Overvoltage protection circuit with self-test
• Periodically verified ADC sampling channels
• Relay status detection with startup self-test

4.6 Category 3 Detailed Explanation

Definition: Dual-channel architecture with single fault tolerance, safety function can still be performed when fault occurs.

Technical Requirements:

Requirement Item	Specific Content	Verification Method
Basic safety principles	Must be followed	Design review
Proven safety principles	Must be followed	Design review
MTTFd	Low to high	Calculation/table lookup
DC	Low to medium	Diagnostic analysis
CCF	Measures needed (score ≥65)	CCF scoring
Fault behavior	Single fault does not affect safety function	Fault analysis
Fault accumulation	Accumulation of single faults not considered	N/A

Key Design Requirements:

1. Redundancy Design:

   • Two independent channels
   • Either channel can independently perform safety function
   • Can use diverse technologies (different component types)

2. Fault Detection:

   • Cross monitoring between channels
   • Trigger safety response when fault detected
   • No need for high DC (low-medium is sufficient)

Specified Architecture Diagram:

graph LR
    subgraph "Category 3 Architecture"
        I[Input I] --> L1[Logic L1]
        I --> L2[Logic L2]
        L1 --> O1[Output O1]
        L2 --> O2[Output O2]
        L1 <--> L2
        L1 -.Cross monitoring.-> CM[Monitoring]
        L2 -.Cross monitoring.-> CM
    end

    style I fill:#e3f2fd
    style L1 fill:#bbdefb
    style L2 fill:#bbdefb
    style O1 fill:#90caf9
    style O2 fill:#90caf9
    style CM fill:#64b5f6

    note[Feature: Dual-channel redundancy, single fault does not affect safety function]

Applicable Scenarios:

• PLr requirement is d or e (requires sufficiently high MTTFd and DC)
• Need continuous availability
• Medium to high risk applications
• High reliability requirements

BMS Application Example:

• Dual-MCU architecture battery protection system
• Dual ADC sampling channels with cross verification
• Redundant voltage/current detection circuits

4.7 Category 4 Detailed Explanation

Definition: Architecture with highest fault tolerance capability, can tolerate fault accumulation.

Technical Requirements:

Requirement Item	Specific Content	Verification Method
Basic safety principles	Must be followed	Design review
Proven safety principles	Must be followed	Design review
MTTFd	High (usually >100 years)	Calculation/table lookup
DC	High (>99%)	Diagnostic analysis
CCF	Measures needed (score ≥65)	CCF scoring
Fault behavior	Single fault does not affect safety function	Fault analysis
Fault accumulation	Fault accumulation does not affect safety function	Accumulated fault analysis

Key Differences from Category 3:

Comparison	Category 3	Category 4
Fault accumulation	Not considered	Must be considered
DC requirement	Low-Medium	High (>99%)
MTTFd limit	100 years	2500 years
Achievable PL	a-e (requires high parameters)	a-e (easier to achieve PL e)
Design complexity	High	Very high
Cost	High	Very high

Specified Architecture Diagram:

graph LR
    subgraph "Category 4 Architecture"
        I[Input I] --> L1[Logic L1]
        I --> L2[Logic L2]
        L1 <--> L2
        L1 --> O1[Output O1]
        L2 --> O2[Output O2]
        O1 <--> O2

        L1 -.Diagnosis.-> HD[High Coverage Diagnosis]
        L2 -.Diagnosis.-> HD
        O1 -.Diagnosis.-> HD
        O2 -.Diagnosis.-> HD
    end

    style I fill:#e3f2fd
    style L1 fill:#bbdefb
    style L2 fill:#bbdefb
    style O1 fill:#90caf9
    style O2 fill:#90caf9
    style HD fill:#42a5f5

    note[Feature: Dual-channel redundancy + high diagnostic coverage + fault accumulation tolerance]

Applicable Scenarios:

• PLr requirement is e
• Highest safety integrity requirements
• Critical life safety applications
• Very serious fault consequences

BMS Application Example:

• Battery management system main control with highest safety level
• BMS architecture compliant with ASIL-D (automotive applications)
• Core protection functions for large-scale energy storage systems

---

V. Category Selection Guide and Decision Methods

5.1 Decision Tree for Category Selection Based on PLr

graph TD
    A[Determine PLr] --> B{PLr Level?}

    B -->|PLr = a| C[Category B]
    B -->|PLr = b| D{Selection Strategy}
    B -->|PLr = c| E{Selection Strategy}
    B -->|PLr = d| F{Selection Strategy}
    B -->|PLr = e| G{Selection Strategy}

    D -->|Cost priority| C
    D -->|Reliability priority| H[Category 2]

    E -->|Traditional components| I[Category 1]
    E -->|Modern design| H
    E -->|High reliability| J[Category 3]

    F -->|Cost sensitive| H
    F -->|High reliability| J

    G -->|Standard solution| J
    G -->|Highest reliability| K[Category 4]

    style C fill:#c8e6c9
    style I fill:#a5d6a7
    style H fill:#81c784
    style J fill:#66bb6a
    style K fill:#4caf50

5.2 PLr to Category Mapping

PLr	Recommended Category	Alternative Category	Selection Considerations	Typical Applications
a	B	2	Cat B lowest cost, Cat 2 provides higher reliability	Simple indication, non-critical monitoring
b	B	1, 2	Need appropriate MTTFd, Cat 1 can improve reliability	Low risk control, auxiliary functions
c	1	2, 3	Cat 1 uses proven components, Cat 2/3 provides diagnostics	Medium risk protection, general safety functions
d	2	3	Cat 3 higher reliability, suitable for high risk	Critical protection functions, personnel safety
e	3	4	Cat 4 easier to achieve PL e, but higher cost	Very high risk, life safety

5.3 Comprehensive Considerations for Category Selection

1. Technical Complexity Comparison:

Category	Relative Complexity	Implementation Difficulty	Development Cycle	Maintenance Difficulty
B	★☆☆☆☆	Low	Short	Low
1	★★☆☆☆	Low	Short	Low
2	★★★☆☆	Medium	Medium	Medium (test verification needed)
3	★★★★☆	High	Long	Medium (self-diagnosis)
4	★★★★★	Very high	Very long	Medium (self-diagnosis)

2. Cost Factor Analysis:

graph LR
    subgraph "Category Cost Comparison (Relative Values)"
        A[Cat B: 1.0x] --> B[Cat 1: 1.2x]
        B --> C[Cat 2: 1.5-2.0x]
        C --> D[Cat 3: 2.5-3.5x]
        D --> E[Cat 4: 3.5-5.0x]
    end

    style A fill:#c8e6c9
    style B fill:#a5d6a7
    style C fill:#81c784
    style D fill:#66bb6a
    style E fill:#4caf50

Cost Components:

• Hardware cost: B/1 lowest, 3/4 need redundant hardware
• Development cost: Increases with complexity
• Verification cost: 2/3/4 need more verification testing
• Maintenance cost: 2 needs periodic verification, 3/4 self-diagnosis reduces maintenance cost

3. Maintenance Considerations:

Category	Maintenance Requirements	Verification Frequency	Fault Indication	Downtime Impact
B	Basic maintenance	As needed	None	Fault means failure
1	Basic maintenance	As needed	None	Fault means failure
2	Verify test function	Periodic	Yes	Test may require downtime
3	Monitor diagnostics	Continuous	Yes	Self-diagnosis, simple maintenance
4	Monitor diagnostics	Continuous	Yes	Self-diagnosis, simple maintenance

5.4 Category Selection for Special Scenarios

Scenario 1: Mature Components Available

• Recommendation: Category 1
• Reason: Use proven components, can achieve PL c, low cost
• Example: Use mature safety relays

Scenario 2: High Reliability Needed but Cost Sensitive

• Recommendation: Category 2
• Reason: Periodic testing provides higher reliability, moderate cost
• Example: Industrial equipment with regular maintenance

Scenario 3: High Risk Application, Cannot Tolerate Faults

• Recommendation: Category 3
• Reason: Single fault tolerance, continuous availability
• Example: Personnel protection equipment

Scenario 4: Very High Risk, Serious Fault Consequences

• Recommendation: Category 4
• Reason: Highest reliability, fault accumulation tolerance
• Example: Life safety critical systems

---

VI. Correspondence Between PL and SIL

6.1 Technical Background

PL from ISO 13849-1 and SIL from IEC 62061 are both indicators of safety integrity. Both are based on the same underlying metric (PFH), enabling a correspondence between them.

Standard Application Areas:

• ISO 13849: Machinery safety, applicable to all technical fields
• IEC 62061: Machinery safety, mainly for electrical/electronic systems

6.2 PL vs SIL Correspondence Table

PFH Range	PL (ISO 13849)	SIL (IEC 62061)	Interoperability
≥10⁻⁵ to <10⁻⁴	a	-	Not applicable
≥3×10⁻⁶ to <10⁻⁵	b	1	Can be mixed
≥10⁻⁶ to <3×10⁻⁶	c	1	Can be mixed
≥10⁻⁷ to <10⁻⁶	d	2	Can be mixed
≥10⁻⁸ to <10⁻⁷	e	3	Can be mixed

graph LR
    subgraph "PL vs SIL Correspondence"
        A[PL a<br/>No corresponding SIL] --> B[PL b/c<br/>Corresponds to SIL 1]
        B --> C[PL d<br/>Corresponds to SIL 2]
        C --> D[PL e<br/>Corresponds to SIL 3]
    end

    style A fill:#ffebee
    style B fill:#fff3e0
    style C fill:#e8f5e9
    style D fill:#c8e6c9

6.3 Mixing Principles and Considerations

Mixing Principles:

• PL b/c components can be used in SIL 1 systems
• PL d components can be used in SIL 2 systems
• PL e components can be used in SIL 3 systems

Mixing Considerations:

1. Interface Compatibility:

   • Ensure interfaces and communication methods comply with both standards
   • Verify data exchange integrity

2. Verification Methods:

   • PL uses simplified method (Category + MTTFd + DC)
   • SIL uses full IEC 61508 method
   • Coordinate verification methods when mixing

3. Documentation Requirements:

   • Maintain documentation for both standards
   • Explain rationale for mixing

Practical Application Examples:

Application Scenario	PL System	SIL System	Mixing Solution
Robot arm control	PL d safety function	SIL 2 control system	PL d components for SIL 2
BMS protection	PL e overvoltage protection	SIL 2 diagnostic function	Coordinate interface and verification

---

VII. Practical Application Cases

7.1 Case 1: BMS Overvoltage Protection Function

Scenario Description: Overvoltage protection safety function for industrial lithium battery packs, preventing thermal runaway from battery overcharge.

Risk Assessment:

Parameter	Assessment	Detailed Rationale
S (Severity)	S2	Overcharge may cause fire, explosion, resulting in serious injury or death
F (Frequency)	F2	Batteries are charged daily, frequent exposure
P (Possibility of Avoidance)	P2	Thermal runaway develops rapidly, difficult for personnel to avoid injury

PLr Determination: S2 + F2 + P2 → PLr = e

Category Selection Analysis:

Category	Feasibility	Analysis Conclusion	Recommendation
Cat 2	Theoretically possible	Needs very high MTTFd and DC, difficult to implement	★★
Cat 3	Recommended	Dual-channel redundancy, can achieve PL e	★★★★
Cat 4	Best	High DC + fault accumulation tolerance, most reliable	★★★★★

Design Solution (Category 3):

graph TD
    subgraph "BMS Overvoltage Protection - Category 3 Architecture"
        V[Battery Voltage] --> ADC1[ADC Channel 1]
        V --> ADC2[ADC Channel 2]

        ADC1 --> MCU1[MCU1<br/>Main Control]
        ADC2 --> MCU2[MCU2<br/>Slave Control]

        MCU1 <--> MCU2
        MCU1 --> SW1[Switch 1]
        MCU2 --> SW2[Switch 2]

        MCU1 -.Diagnosis.-> DIAG[Cross Diagnosis]
        MCU2 -.Diagnosis.-> DIAG

        DIAG -->|Fault Detection| ALARM[Alarm]
        DIAG -->|Fault Detection| SHUTDOWN[Shutdown]
    end

    style V fill:#e3f2fd
    style MCU1 fill:#bbdefb
    style MCU2 fill:#bbdefb
    style DIAG fill:#64b5f6
    style SHUTDOWN fill:#ef5350

Design Points:

• Input: Dual ADC sampling voltage, cross verification
• Logic: Two independent MCUs calculate separately
• Output: Dual independent shutdown circuits
• Diagnostics: Cross monitoring between channels
• MTTFd: Select high reliability components
• DC: Implement medium diagnostic coverage

7.2 Case 2: BMS Temperature Monitoring Function

Scenario Description: Battery pack temperature monitoring function, alarms and limits power when temperature exceeds threshold.

Risk Assessment:

Parameter	Assessment	Detailed Rationale
S (Severity)	S2	High temperature may cause thermal runaway
F (Frequency)	F2	Battery pack continuous operation, continuous temperature monitoring
P (Possibility of Avoidance)	P1	Temperature rise has warning, time to take measures

PLr Determination: S2 + F2 + P1 → PLr = d

Category Selection Analysis:

Category	Feasibility	Analysis Conclusion	Recommendation
Cat 2	Feasible	Needs higher MTTFd and DC	★★★
Cat 3	Recommended	Easier to achieve PL d, higher reliability	★★★★

Design Solution (Category 2):

graph TD
    subgraph "BMS Temperature Monitoring - Category 2 Architecture"
        T[NTC Temperature Sensor] --> AMP[Amplifier Circuit]
        AMP --> ADC[ADC Sampling]
        ADC --> MCU[MCU Processing]

        MCU --> COMP[Threshold Comparison]
        COMP -->|Normal| MON[Normal Monitoring]
        COMP -->|Overtemperature| LIMIT[Power Limiting]

        TEST[Test Unit] -.Periodic Test.-> AMP
        TEST -.Periodic Test.-> ADC
        TEST -.Periodic Test.-> COMP

        TEST -->|Test Failure| SAFE[Safe State]
    end

    style T fill:#e3f2fd
    style MCU fill:#bbdefb
    style TEST fill:#fff176
    style SAFE fill:#ef5350

Design Points:

• Periodic Testing: Startup and periodic self-test
• Test Coverage: Covers sensor, amplifier, ADC
• Test Frequency: Every startup + every 8 hours
• MTTFd: Medium reliability sufficient
• DC: Low-medium diagnostic coverage

7.3 Case 3: BMS Insulation Monitoring Function

Scenario Description: Insulation resistance monitoring function for high-voltage battery packs, detecting insulation faults.

Risk Assessment:

Parameter	Assessment	Detailed Rationale
S (Severity)	S2	High-voltage electric shock can be fatal
F (Frequency)	F1	Insulation monitoring continuous, but electric shock accidents rare
P (Possibility of Avoidance)	P2	Electric shock no warning, difficult to avoid

PLr Determination: S2 + F1 + P2 → PLr = d

Design Solution (Category 3):

graph TD
    subgraph "Insulation Monitoring - Category 3 Architecture"
        BAT[High Voltage Battery Pack] --> R1[Insulation Resistance 1]
        BAT --> R2[Insulation Resistance 2]

        R1 --> M1[Monitoring Channel 1]
        R2 --> M2[Monitoring Channel 2]

        M1 --> C1[Calculation Unit 1]
        M2 --> C2[Calculation Unit 2]

        C1 <--> C2
        C1 -->|Insulation Fault| RELAY[Relay Open]
        C2 -->|Insulation Fault| RELAY

        C1 -.Diagnosis.-> DIAG[Cross Diagnosis]
        C2 -.Diagnosis.-> DIAG
    end

    style BAT fill:#e3f2fd
    style C1 fill:#bbdefb
    style C2 fill:#bbdefb
    style RELAY fill:#ef5350

---

VIII. Common Questions FAQ

Q1: Must I use the lowest category corresponding to PLr?

A: No. You can use a higher category to achieve PLr, as long as the final achieved PL ≥ PLr.

Example:

• PLr = c function can be implemented using Category 3
• Need to calculate actual achieved PL, confirm PL ≥ c
• Using higher category may increase cost but improves reliability

Q2: What is the main difference between Category 2 and Category 3?

A: Main difference is fault tolerance capability:

Comparison	Category 2	Category 3
Architecture	Single channel + test	Dual-channel redundancy
Fault tolerance	None	Single fault tolerance
Fault exposure	During test interval	No exposure
Applicable PLr	a-d	a-e
Implementation difficulty	Medium	High

For high PLr (d, e), Category 3 is usually easier to achieve.

Q3: How to choose between Category B and Category 1?

A: Selection basis:

Choose Category B	Choose Category 1
PLr is a or b	PLr is c
Cost sensitive	Have mature proven components
Simple application	Can use traditional components
Low risk	Need higher reliability

Q4: What is the difference between Category 4 and Category 3 in practical applications?

A: Key differences:

Comparison	Category 3	Category 4
DC requirement	Low-Medium	High (>99%)
MTTFd limit	100 years	2500 years
Fault accumulation	Not considered	Must be considered
Design complexity	High	Very high
Cost	High	Very high
Achieving PL e	Needs high parameters	Easier to implement

Category 4 design is more complex but easier to achieve PL e.

Q5: When should the “hazardous event probability” in the risk graph be considered?

A: The standard allows considering this parameter in specific cases, but:

General Principle:

• In most cases, assume hazardous event will occur
• Do not use this parameter for downgrading

Exception Cases:

• Hazardous event probability is truly negligible
• Multiple independent faults need to occur simultaneously
• Sufficient probability analysis support

Recommendation:

• Conservative assessment, do not easily use downgrading
• Ensure sufficient technical basis

Q6: What category does a BMS system typically need?

A: Depends on specific safety functions and PLr:

Safety Function	PLr	Recommended Category	Description
Status indication	a-b	B	Non-safety critical
Under-voltage protection	c	1 or 2	Medium risk
Over-current protection	c-d	2 or 3	Higher risk
Over-temperature protection	d	2 or 3	High risk
Over-voltage protection	e	3 or 4	Very high risk
Insulation monitoring	d	2 or 3	High risk

Q7: How to verify that the required PL has been achieved?

A: Verification process:

graph TD
    A[Determine PLr] --> B[Select Category]
    B --> C[Calculate MTTFd]
    C --> D[Determine DCavg]
    D --> E{Category 2/3/4?}
    E -->|Yes| F[Evaluate CCF]
    E -->|No| G[Check PL Table]
    F --> G
    G --> H[Determine Achieved PL]
    H --> I{PL ≥ PLr?}
    I -->|Yes| J[Verification Passed]
    I -->|No| K[Adjust Design]
    K --> B

    style J fill:#c8e6c9
    style K fill:#ffcdd2

---

IX. Summary and Implementation Recommendations

9.1 Core Points Summary

1. PL is a quantitative indicator of safety integrity

• Measures five levels from PL a to PL e through PFH values
• Higher PL means exponentially increasing reliability requirements
• PL corresponds to SIL

2. PLr is determined through risk graph

• Based on three parameters: Severity (S), Frequency/Exposure (F), Possibility of Avoidance (P)
• From S1+F1+P1 (PL a) to S2+F2+P2 (PL e)
• Prioritize Type C standards, risk graph as backup

3. Category is the architectural foundation for achieving PL

• Category B/1/2/3/4 correspond to different fault tolerance capabilities
• Need to combine MTTFd, DCavg, CCF and other parameters to determine achieved PL
• Category selection requires comprehensive consideration of technology, cost, maintenance

4. Core principles of design and verification

• Achieved PL must ≥ PLr
• Reasonably select category to balance cost and safety
• Complete documentation is the foundation of verification

9.2 Implementation Recommendations

Product Design Phase:

1. Risk Assessment

   • Identify all safety functions
   • Use risk graph to determine PLr for each function
   • Document risk assessment process

2. Category Selection

   • Select appropriate category based on PLr
   • Consider technical feasibility, cost, maintenance
   • Evaluate advantages and disadvantages of different solutions

3. Architecture Design

   • Design system architecture according to category requirements
   • Select appropriate components (affects MTTFd)
   • Design diagnostic mechanisms (affects DC)
   • Consider common cause failures (CCF)

Verification Phase:

1. Parameter Calculation

   • Calculate MTTFd values
   • Determine DCavg
   • Evaluate CCF (for categories 2/3/4)

2. PL Verification

   • Check table to determine achieved PL
   • Verify PL ≥ PLr
   • Analyze gaps and improve

3. Documentation Preparation

   • Safety requirements specification
   • System design description
   • Calculation analysis report
   • Verification test report

9.3 Best Practices

1. Conservative Assessment Principle

• Choose higher PLr when uncertain
• Use mature proven components
• Consider the most severe foreseeable consequences

2. Continuous Improvement

• Collect field failure data
• Optimize MTTFd and DC
• Improve system architecture

3. Document Management

• Maintain complete design records
• Document all assumptions and decisions
• Facilitate subsequent audit and improvement

---

References

Standards Documents

1. ISO 13849-1:2023 - Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design
2. ISO 13849-2:2012 - Safety of machinery - Safety-related parts of control systems - Part 2: Validation
3. IEC 62061 - Safety of machinery - Functional safety of safety-related control systems
4. IEC 61508 - Functional safety of electrical/electronic/programmable electronic safety-related systems

Technical Guides

5. IFA Report 2/2017e - Application of ISO 13849-1 and IEC 62061 in the design of safety-related control systems
6. DGUV Information 209-013 - Application of the new standards for safety-related control systems

Related Articles

7. ISO 13849 Overview - Standard Framework and Core Concepts
8. ISO 13849 Parameters Explained - MTTFd, DC, CCF Calculation Methods

---

This article is the second part of the ISO 13849 standard interpretation series. In the next article, we will deeply explore the calculation methods for key parameters such as MTTFd, DCavg, and CCF.