In functional safety, a machine safety function must do more than react once. It must perform reliably under foreseeable operating conditions and fault conditions.
That is where performance levels, or PL, become important. A performance level specifies the ability of safety-related parts of a control system to execute a defined safety function. In practice, this helps engineers evaluate whether a safety circuit or safety subcircuit provides the required level of risk reduction.
This article gives a compact overview of the main parameters used to determine the performance level. It is intended as a technical guide, not as a substitute for a project-specific risk assessment, validation or standards review.
A performance level describes the ability of a safety circuit to perform a safety function under foreseeable conditions. Performance levels are specified as five discrete levels:
PL a represents the lowest level and PL e the highest level within this classification.
Performance levels are determined only for complete safety circuits or complete safety subcircuits. They are not assigned to isolated standard components without considering the full safety-related function and circuit architecture.
Before a performance level can be evaluated, the machine risk must be assessed. The risk assessment defines the required level of risk reduction for each safety function.
Based on that risk assessment, a required performance level is assigned to each safety circuit that executes a safety function or safety subfunction. The achieved performance level of the created circuit must then be evaluated against that requirement.
This sequence is important:
1. Identify the hazard
2. Determine the required performance level
3. Define the required safety function
4. Design the safety circuit or safety subcircuit
5. Evaluate whether the achieved performance level meets the requirement
6. Validate the safety function in the machine context
Several quantitative and qualitative parameters influence the achieved performance level. The following overview explains the most important ones.
The structure of a safety circuit depends on the layout of the components, diagnostics, and reliability measures. These structures are divided into categories B to 4.
The category describes how resistant the safety circuit is to faults and how the circuit behaves when a fault occurs. For example, the architecture can influence whether a single fault can lead to the loss of the safety function or whether the fault is detected and managed.
The Mean Time to Dangerous Failure, or MTTFD considers the reliability of the components used in the safety circuit.
MTTFD focuses on dangerous failures. These are failures that can prevent the safety function from being performed correctly. The reliability data of all relevant safety-related components must be considered in the context of the complete circuit.
Diagnostic Coverage, or DC, measures the effectiveness of the diagnostics in the safety circuit.
It describes the proportion of dangerous failures that can be detected compared with dangerous failures that remain undetected. In general, a higher risk requires more effective diagnostics. That is why diagnostic measures can have a major influence on the performance level achieved.
Common Cause Failures, or CCF, occur when two or more separate faults are caused by the same issue.
This is especially relevant for multi-channel safety circuits. Even if two channels are designed separately, a common cause such as environmental stress, incorrect installation, unsuitable design assumptions, or a shared supply issue can affect both channels. Measures against common cause failures help reduce the probability that multiple channels will fail for the same reason.
The behavior of a safety circuit under fault conditions must be evaluated. Important faults and failures should be analyzed using suitable methods such as:
Depending on the application, circuit category and selected components, additional design or diagnostic measures may be required to meet ISO 13849 requirements.
If safety-related user software is part of the control system, the development process must include measures to prevent faults.
A structured development model, such as the V-model, can support specification, implementation, verification, and validation. The objective is software that is readable, understandable, testable, maintainable, and as free from faults as possible.
Systematic failures are not random hardware failures. They are often the result of human, process or design-related causes.
Examples include:
A functional safety plan is one of the most important tools for addressing systematic failures. It defines measures to prevent incorrect specification, implementation, verification, validation or modification of safety-related functions.
The final performance level evaluation brings all the relevant parameters together. The overview should show how the circuit category, MTTFD, diagnostic coverage, common cause failure measures, fault behavior, software quality, and systematic failure measures contribute to the achieved PL of the safety function.
Evaluating the performance level is not just a calculation exercise. It is a safety engineering task that depends on the complete machine context.
The same component can behave differently depending on the safety function, circuit structure, diagnostics, software, environment, and validation concept. That is why safety-related circuits should be evaluated in relation to the overall functions or subfunctions, not the isolated components.
Festo provides machine builders with automation components, documentation and application knowledge that can support them during safety-related design work. The final responsibility for risk assessment, implementation, and validation remains with the machine builder or the engineering team.