Standards and certifications
Mobile Panel 7100 User's manual 1.51
121
Starting point for the
risk assessment of
the safety-related
part of the controller
Figure 47: Risk graph for determining the PLr for each safety function
Parameter S ... Severity of injury
S1
Slight (normally reversible injury).
S2
Serious (normally irreversible injury or death)
Parameter F ... Frequency and/or exposure to hazard
F1
Seldom to less often and/or exposure time is short.
F2
Frequent to continuous and/or exposure time is long.
Parameter P ... Possibility of avoiding hazard or limiting harm
P1
Possible under specific conditions.
P2
Scarcely possible.
Other
L
Low contribution to risk reduction
H
High contribution to risk reduction
PL
r
Required performance level
Table 34: Legend for the risk graph
5.2.7 Selecting the performance level and category per EN ISO 13849-1
The machinery directive dictates that a defect in the logic of the control loop – or disturbance or damage to the
control loop itself – is not permitted to result in a dangerous situation. This general approach is standardized
in EN ISO 13849-1 "Safety-related parts of control systems", which defines performance levels (PL a to e) for
safety-related control systems. The PL depends on the category, the MTTF
d
value and the DC of the corresponding
safety circuit. The CCF examination must also be performed.
As in the earlier EN 954-1 standard, the category describes the structure of the safety functions. What is new is
the performance level (PL), which describes the safety function's probability of failure and ability to detect faults.
The PL is selected by the machine manufacturer according to the actual potential for hazardous situations deter-
mined by the danger and risk assessment. At a minimum, PL d is normally required for dangers that can result
in irreversible injury or death.
The category specified with the PL provides information about the following:
•
Whether the system is designed as a 1-channel system, in which case a fault could lead to a loss of the
safety function but component availability is high (category 1)
•
Whether the system is designed as a 1-channel system, in which case a fault could lead to a loss of the
safety function but the fault is detected by the system and indicated in one form or another (category 2)
•
Whether the system is designed as a 2-channel system and a fault will not lead to a loss of the safety
function (category 3)
•
Whether the system is designed as a 2-channel system and an accumulation of faults will not lead to a
loss of the safety function (category 4)
In this regard, it is important to note that in category 3 and later, single faults must be detected promptly in order
to prevent an accumulation of faults, which could then result in a loss of the safety function.