A machine can be well-built, well-wired and still fail the one test that matters most: does it stop a person getting hurt? That question has a formal answer in machine safety — the Performance Level, or PL — and it’s become one of the most misunderstood parts of control systems design. Here’s how we think about it, and why it shapes every control system we build.
What is Performance Level (PL)?
EN ISO 13849-1 is the international standard for the safety-related parts of machine control systems. It defines Performance Level on a scale from a (lowest) to e (highest), describing how reliably a safety function — an emergency stop, a guard interlock, a light curtain — will do its job when it’s needed. Every safety function on a machine has a required PL, set by risk assessment, and an achieved PL, set by how the control system is actually built. The job of a control systems engineer is to make sure the second number is never lower than the first.
Where SISTEMA fits in
SISTEMA is a free software tool developed by the IFA — Germany’s Institute for Occupational Safety and Health — in cooperation with ZVEI and VDMA. It’s the de facto standard tool for modelling safety-related control architecture against EN ISO 13849-1, and it calculates the achieved PL from four inputs:
- Category & architecture (B, 1, 2, 3 or 4) — how much redundancy and monitoring the safety function has
- MTTFd — the mean time to dangerous failure of each component
- DCavg — average diagnostic coverage, how well faults are detected
- CCF — resistance to common cause failure
Put those together and SISTEMA gives you a defensible, calculated PL — not a guess, and not a number pulled from a datasheet in isolation.
Why we build every system around it
A lot of functional safety work happens backwards: a machine gets built, then someone checks whether it’s safe enough. We do it the other way round. The required PL for each safety function comes out of the risk assessment before detailed design starts, the control and safety architecture is chosen to meet it, and every function is modelled in SISTEMA to confirm the achieved PL — all before a cabinet is wired or a line of safety-PLC code is written. It’s a slower first step, and a much faster, cheaper project after that, because there’s no redesign-and-retest cycle waiting at the end.
Upgrading machinery that falls short
Most of the PL work we do isn’t on new machines — it’s on existing ones. A line gets modified, a risk assessment gets revisited, or a customer’s own safety review flags that a guard interlock or e-stop circuit no longer meets the PL the process now requires. We audit the existing safety functions, identify exactly where the gap is, and scope the most practical route to close it — sometimes a component swap and added diagnostics, sometimes a fuller re-architecture of the safety circuit. Either way, the upgrade gets re-modelled in SISTEMA and validated on-site, with documentation handed over for the machine’s safety file.
Independent verification, not just our own sign-off
On projects that call for it, we work alongside independent, certified functional safety specialists to verify our PL and SIL calculations. Our own SISTEMA modelling is the design tool; independent verification is what makes the compliance record hold up to audit, not just to our own review.
Proven where compliance can’t be an afterthought
A large part of our control systems and inspection work sits inside pharmaceutical and other GMP-regulated manufacturing environments, where documentation, traceability and validation evidence are non-negotiable. That discipline carries straight across into how we handle functional safety — the same rigour applied to product quality gets applied to the safety file.
If a control systems project or a Performance Level upgrade is on your list, we’d be glad to talk it through.
Leave a Reply