Understanding ISO 13849: A Practical Guide for Machine Builders

ISO 13849-1 is the international standard for designing and validating safety-related control systems on machinery. If you build machines that will be sold into the EU — or that carry CE marking requirements — you need to understand how to apply it correctly. This guide covers the core concepts, the Performance Level calculation, and the documentation you must produce before a machine ships.

What ISO 13849 Actually Covers

ISO 13849-1 covers the design of safety functions — the control actions that reduce risk when a hazard is present. Common examples include: emergency stop, guard door interlocking, two-hand control, and enabling devices. The standard defines how reliable these safety functions must be, expressed as a Performance Level (PL) from PLa (lowest) to PLe (highest).

It does not cover the machine's structural integrity, electrical insulation, or ergonomics. Those are covered by other standards (EN ISO 12100 for risk assessment, IEC 60204-1 for electrical equipment). ISO 13849 is specifically about the control system's contribution to safety.

Step 1 — Risk Assessment First

You cannot assign a Performance Level requirement without first doing a risk assessment under EN ISO 12100. The risk assessment identifies the hazards, the people exposed, and the probability and severity of harm. From this you determine the required PLr (required Performance Level) for each safety function.

ISO 13849-1 Annex A provides a risk graph with two input parameters:

Running through the risk graph gives you the PLr: typically PLc or PLd for most industrial machinery hazards. PLe is reserved for the highest-severity applications such as automotive press lines or industrial robots where human entry into the hazard zone is routine.

Step 2 — Categories and Architecture

Once you know your PLr, you need to design a safety circuit architecture (Category) that can achieve it. ISO 13849-1 defines five Categories:

For PLd — the most common requirement on industrial machinery — Category 3 dual-channel architecture with a safety relay or safety PLC is the standard approach. Most modern safety PLCs (Siemens F-CPU, Rockwell GuardLogix, Pilz PNOZmulti) are certified to Category 3/PLe as hardware, giving you significant design headroom.

Step 3 — Calculating Achieved PL

After selecting your architecture and components, you must demonstrate that the achieved PL meets or exceeds PLr. The calculation combines three reliability metrics:

The simplest tool for this calculation is SISTEMA (Safety Integrity Software Tool for the Evaluation of Machine Applications), published free by IFA (Germany). SISTEMA takes your component data and architecture and outputs the achieved PL. It also generates a calculation report that forms part of your technical file.

Step 4 — Safety Function Documentation

ISO 13849-2 (the validation standard) and the Machinery Directive both require that each safety function be formally documented. At minimum you need:

This package forms part of the machine's technical file. Without it, CE marking under the Machinery Directive (2006/42/EC — being replaced by the 2023 Machinery Regulation 2023/1230/EU from January 2027) is not achievable.

Common Mistakes We See in the Field

FERSMEK's Approach to Functional Safety

On every project where machinery safety is in scope, we produce a full safety function specification before programming starts. This document captures the PLr for each function, the chosen architecture, the component list, and the SISTEMA calculation. It is reviewed by the client before commissioning and updated if the design changes.

We work with Siemens F-CPU (TIA Portal Safety Advanced), Rockwell GuardLogix (Studio 5000 Logix Designer Safety), and Pilz PNOZmulti. For clients who need to prepare their own technical file for CE marking, we can provide the SISTEMA project file and documentation package as a project deliverable.