ISO 13849 is the machinery standard for the safety related parts of control systems. It rates safety functions by performance level, from PL a to PL e, and ties what you can achieve to a control architecture category, from B to 4. A single channel design cannot reach the top level.
Two parts
Part 1 covers design principles and Part 2 covers validation. The standard is described as a simplified version, tailored for the machinery sector, of generic functional safety approaches such as IEC 61508. It applies to control systems using hardware or software.
Required and achieved levels
The manufacturer's risk assessment sets the required performance level (PLr) for each safety function, such as stopping a motor when a guard opens. The design then has to achieve at least that level.
Each PL is a band of failure rates, and PL e is the most demanding, at or below about 1 in 100 million dangerous failures per hour. The quantified measure behind each band is the probability of dangerous failure per hour (PFHd).
Categories and the ceiling they set
- Category B: single channel, basic components. Maximum PL b.
- Category 1: single channel with well tried high reliability components. Maximum PL c.
- Category 2: single channel with diagnostic testing. Maximum PL d.
- Category 3: redundant channels with cross monitoring. Maximum PL e.
- Category 4: redundant channels with high diagnostic coverage (99 percent or more) and stricter rules on accumulated faults. PL e.
The pattern is easy to remember: more independence and better self checking raise the ceiling.
Validation
Validation can combine analysis, functional testing and documentation. For a software team, that means requirements, test cases for each fault you claim to detect, and records.
What it means for firmware and PLC code
The safety function lives in hardware and software. Treat the program that implements it as part of the safety evidence: version it, review it, test it with injected faults, and control who can change it. A pretty architecture on paper is wasted if anyone can reload different logic.
Compare this scheme with the others in our post on SIL, PL and ASIL, and see interlock design and bypass risk.
A worked reading
Suppose a risk assessment says a guard door safety function needs PL d. Category 2 can reach PL d, but only with diagnostic testing that actually catches the faults you care about, and with components of suitable quality. If the same function needed PL e, a single channel is ruled out and the design needs two channels that monitor each other (category 3) or an even higher diagnostic coverage (category 4).
This is why the first question to a machine builder is not which PL the machine has, but which PL each safety function needs and achieves. A machine can have several safety functions at different levels, for example a door interlock and an emergency stop.
Pitfalls to watch for:
Treating the category as the whole answer. The category sets a ceiling. Component quality, diagnostics and failure rates decide where under the ceiling you land.
Forgetting software. Logic that implements the function needs the same review and change control as the wiring.
Changing the machine later. A new guard, a bypass added for convenience or a modified program can silently void the analysis. Re-run the assessment after any change that touches a safety function.
Unvalidated assumptions. Part 2 of the standard exists because a calculation that nobody tested proves little.
Quick check
Can a single channel design reach PL e?
No. Per the reference, single channel categories top out at PL d, and PL e needs category 3 or 4.
Who decides the required PL?
It comes from the manufacturer's risk assessment of each safety function.
Sources
Secondary summary; use the standard for exact requirements.
Last reviewed: 19 October 2026.
