ISO 13849-1 : Standard of Industrial Safety, Performance Level d (PL d)

PL d Advanced Training: Control System Safety Guide

PL d Education

Module 1: Definition
Module 2: Requirements
Module 3: Circuit
Module 4: Verification

ISO 13849-1 Advanced Course

Standard of Industrial Safety,

Performance Level d (PL d)

Why do robots and automation systems require PL d?

Learn the design know-how to reduce the probability of dangerous failure to 1 in 10 million.

Module 1. Definition and Meaning of PL d

How safe must it be to be PL d?

Probability of Dangerous Failure per Hour (PFHd)

The PL grade is not just saying “it’s safe”.

It quantifies the “probability of a dangerous failure occurring during 1 hour of operation”.

PL
PFHd (1/h)
Reliability Level

PL c
≥ 10-6 ~ < 3 × 10-6
1 in a Million

PL d
≥ 10-7 ~ < 10-6
1 in 10 Million

PL e
≥ 10-8 ~ < 10-7
1 in 100 Million

Why is PL d for Robots?

Serious Injury (Severity)
Possibility of fracture, amputation, or death upon collision.

Frequent Exposure (Frequency)
Operators frequently approach the robot in automation lines.

Possibility of Avoidance
Can be avoided under specific conditions (e.g., slow speed).

Risk Assessment Result ⇒ Minimum PL d Required

Module 2. Recipe to Achieve PL d

The standard design combination to achieve PL d

The Golden Formula for PL d

Most common “Category 3” based configuration

Category 3

Architectural Requirements

Redundancy
No loss of safety function
even with a single fault

MTTFd

Component Reliability

Medium ~ High
Use certified components
with low failure rates (Check B10d)

DCavg

Diagnostic Coverage

Low ~ Medium
Cross-check (Feedback)
of I/O status

Note: While theoretically Category 2 (Single channel + Test) can achieve PL d, Category 3 (Redundancy) is the industrial standard for robot systems due to control complexity and test cycle limitations.

Module 3. Practical Circuit Design (Category 3)

Example of perfect redundancy from input to output

INPUT

E-Stop Button

NC 1

NC 2

★ 2 Contacts (Redundancy)

LOGIC

Safety PLC / Relay

Channel A Processing

Channel B Processing

Cross Monitoring

OUTPUT

Power Cut-off (MC)

MC 1

MC 2

★ Series Connection

EDM (External Device Monitoring) Feedback Loop

Common Mistakes (Failure Causes)

Single Contact: Connecting E-Stop with only 1 contact (Cat 1 or lower).
Standard PLC: Handling Safety Functions with standard PLC logic (No diagnostics).
Fault Masking: Simple series connection of multiple E-Stop buttons prevents fault detection.

Success Points (Check Point)

EDM Mandatory: Feedback of the output MC’s auxiliary contact (NC) to the safety controller.
CCF Consideration: Separate cabling or shielding to prevent common cause failures.

Module 4. Verification & Software

Manual PL calculation is prone to errors. Verification software is used in the industrial field.

PAScal
Safety calculation software by Pilz

SISTEMA
Free standard tool by IFA (Widely used)

Education Material

Based on EN ISO 13849-1:2015

Advanced Safety Training