ISO 13849-1 : Standard of Industrial Safety, Performance Level d (PL d)

P

PL d Education

Module 1: Definition Module 2: Requirements Module 3: Circuit Module 4: Verification

ISO 13849-1 Advanced Course

Standard of Industrial Safety,
Performance Level d (PL d)

Why do robots and automation systems require PL d?
Learn the design know-how to reduce the probability of dangerous failure to 1 in 10 million.

Module 1. Definition and Meaning of PL d

How safe must it be to be PL d?

Probability of Dangerous Failure per Hour (PFH_d)

The PL grade is not just saying "it's safe".
It quantifies the "probability of a dangerous failure occurring during 1 hour of operation".

PL	PFHd (1/h)	Reliability Level
PL c	≥ 10-6 ~ < 3 × 10-6	1 in a Million
PL d	≥ 10-7 ~ < 10-6	1 in 10 Million
PL e	≥ 10-8 ~ < 10-7	1 in 100 Million

Why is PL d for Robots?

• S2
  Serious Injury (Severity) Possibility of fracture, amputation, or death upon collision.
• F2
  Frequent Exposure (Frequency) Operators frequently approach the robot in automation lines.
• P1
  Possibility of Avoidance Can be avoided under specific conditions (e.g., slow speed).

Risk Assessment Result ⇒ Minimum PL d Required

Module 2. Recipe to Achieve PL d

The standard design combination to achieve PL d

The Golden Formula for PL d

Most common "Category 3" based configuration

1

Category 3

Architectural Requirements

Redundancy

No loss of safety function
even with a single fault

2

MTTF_d

Component Reliability

Medium ~ High

Use certified components
with low failure rates (Check B10d)

3

DC_avg

Diagnostic Coverage

Low ~ Medium

Cross-check (Feedback)
of I/O status

Note: While theoretically Category 2 (Single channel + Test) can achieve PL d, Category 3 (Redundancy) is the industrial standard for robot systems due to control complexity and test cycle limitations.

Module 3. Practical Circuit Design (Category 3)

Example of perfect redundancy from input to output

INPUT

E-Stop Button

NC 1

NC 2

★ 2 Contacts (Redundancy)

LOGIC

Safety PLC / Relay

Channel A Processing Channel B Processing

Cross Monitoring

OUTPUT

Power Cut-off (MC)

MC 1

MC 2

★ Series Connection

EDM (External Device Monitoring) Feedback Loop

Common Mistakes (Failure Causes)

• Single Contact: Connecting E-Stop with only 1 contact (Cat 1 or lower).
• Standard PLC: Handling Safety Functions with standard PLC logic (No diagnostics).
• Fault Masking: Simple series connection of multiple E-Stop buttons prevents fault detection.

Success Points (Check Point)

• EDM Mandatory: Feedback of the output MC's auxiliary contact (NC) to the safety controller.
• CCF Consideration: Separate cabling or shielding to prevent common cause failures.

Module 4. Verification & Software

Manual PL calculation is prone to errors. Verification software is used in the industrial field.

P

PAScal Safety calculation software by Pilz

S

SISTEMA Free standard tool by IFA (Widely used)

Education Material

Based on EN ISO 13849-1:2015

Advanced Safety Training

© Safety Guide. Specialized for PL d.