SIL or PL: which one does your machine need?

Somebody asks whether the machine is SIL 2, and the honest first answer is a question back: which standard is your risk assessment written against?

There are two, they measure the same thing differently, and picking one is a decision you make at the start of a design rather than a label you attach at the end of it.

What each one is for

ISO 13849-1 grew out of machinery safety. It rates a safety function as a Performance Level from a to e, and it gets there from three inputs: the architecture (Category B, 1, 2, 3 or 4), the mean time to dangerous failure of the components, and how much of that failure the system diagnoses itself.

IEC 62061 grew out of the process world's IEC 61508 and was written down to machinery. It rates a function as a Safety Integrity Level, from a probability of dangerous failure per hour.

The scales are harmonised on purpose. PL c corresponds to SIL 1, PL d to SIL 2, PL e to SIL 3. Below that, PL a and PL b have no SIL equivalent, which is itself a hint about what each standard is for.

The rating is the chain, not the box

This is the mistake worth spending a paragraph on, because it is made constantly and it is made in writing, in specifications, by people who should know better.

A safety function runs from the thing that detects the hazard to the thing that removes the energy. Guard switch, logic, contactor. The Performance Level applies to all of it.

So a dual channel safety PLC rated PL e, wired to one mechanical switch on the guard, with one contactor on the motor, is not a PL e safety function. It is a single channel function with two single points of failure and a very expensive middle.

The corollary is more useful: improving the expensive box rarely improves the rating. Adding the second channel at each end usually does.

How the required level is decided

You do not choose the level. It falls out of the risk assessment, which asks three questions about the hazard and reads the answer off a graph.

• Severity: is the likely injury reversible, or not?
• Frequency of exposure: is somebody in the danger zone rarely, or often?
• Possibility of avoidance: can somebody see it coming and get out of the way, or not?

Severe, frequent and unavoidable lands on PL e. Slight, rare and avoidable lands on PL a or b. Most guarding on most machines ends up at PL d, which is why PL d is the level worth knowing the requirements for.

Category is not the same as Performance Level

Categories describe structure: Category 3 means a single fault does not lose the safety function and most faults are detected. Categories 1 and 2 are single channel, with 2 adding a test.

A Category alone does not give you a Performance Level, because two Category 3 systems built from different components have different failure rates. Category is the shape; MTTFd and diagnostic coverage are the numbers that turn a shape into a rating.

Verification and validation are different words

ISO 13849-1 asks for both, and they are commonly conflated.

Verification is the arithmetic: showing on paper that the design meets the required Performance Level, from the architecture and the component data.

Validation is the test: showing on the machine that the function behaves as designed, including with faults injected. Opening the guard stops the motor is not validation. Opening the guard with one channel already broken and still stopping the motor is.

What this means for the logic

Almost none of this lives in your ladder. A safety function achieved by ordinary logic in a standard controller has no rating at all, because a standard PLC has no diagnostic coverage for its own failures and no independent second channel.

That is worth stating plainly, because the sentence people want to write is that their program is safety rated. Logic is not rated. Systems are.

LADX will write you a stop rung and will say this in its notes rather than let the phrase go by. A stop button on glass is not an emergency stop either: an E-stop is a hardwired device, and drawing one on a screen does not make it one.