6.3.1 Safety Circuit Integrity and ISO 13849-1 Safety Circuit Principles
Safety circuits involve the safety-related functions of a machine that minimize the level of risk of harm. These safety-
related functions can prevent initiation, or they can stop or remove a hazard. The failure of a safety-related function or its
associated safety circuit usually results in an increased risk of harm.
The integrity of a safety circuit depends on several factors, including fault tolerance, risk reduction, reliable and well-tried
components, well-tried safety principles, and other design considerations.
Depending on the level of risk associated with the machine or its operation, an appropriate level of safety circuit integrity
(performance) must be incorporated into its design. Standards that detail safety performance levels include ANSI B11.19
Performance Criteria for Safeguarding and ISO 13849-1 Safety-Related Parts of a Control System.
Safety Circuit Integrity Levels
Safety circuits in International and European standards have been segmented into Categories and Performance Levels,
depending on their ability to maintain their integrity in the event of a failure and the statistical likelihood of that failure.
ISO 13849-1 details safety circuit integrity by describing circuit architecture/structure (Categories) and the required
performance level (PL) of safety functions under foreseeable conditions.
In the United States, the typical level of safety circuit integrity has been called "Control Reliability". Control Reliability
typically incorporates redundant control and self-checking circuitry and has been loosely equated to ISO 13849-1 Category
3 or 4 and/or Performance Level “d” or “e” (see ANSI B11.19).
Perform a risk assessment to ensure appropriate application, interfacing/hookup, and risk reduction (see ANSI B11.0 or
ISO 12100). The risk assessment must be performed to determine the appropriate safety circuit integrity in order to
ensure that the expected risk reduction is achieved. This risk assessment must take into account all local regulations and
relevant standards, such as U.S. Control Reliability or European "C" level standards.
The safety controller inputs support up to Category 4 PL e (ISO 13849-1) and Safety Integrity Level 3 (IEC 61508 and IEC
62061) interfacing/hookup. The actual safety circuit integrity level is dependent on the configuration, proper installation of
external circuitry, and the type and installation of the safety input devices. The user is responsible for the determination of
the overall safety rating(s) and full compliance with all applicable regulations and standards.
The following sections deal only with Category 2, Category 3, and Category 4 applications, as described in ISO 13849-1.
The input device circuits shown in the table below are commonly used in safeguarding applications, though other solutions
are possible depending on fault exclusion and the risk assessment. The table below shows the input device circuits and the
safety category level that is possible if all of the fault detection and fault exclusion requirements are met.
WARNING: Risk Assesment
The level of safety circuit integrity can be greatly affected by the design and installation of the safety
devices and the means of interfacing of those devices. A risk assessment must be performed to
determine the appropriate level of safety circuit integrity to ensure the expected risk
reduction is achieved and all relevant regulations and standards are complied with.
WARNING: Input Devices with dual contact inputs using 2 or 3 terminals
Detection of a short between two input channels (contact inputs, but not complementary contacts) is
not possible, if the two contacts are closed. A short can be detected when the input is in the Stop state
for at least 2 seconds (see the INx & IOx input terminals Tip in
page 71).
WARNING: Category 2 or 3 Input Shorts
Detection of a short between two input channels (contact inputs, but not complementary
contacts), if they are supplied through the same source (for example, the same terminal from the
Controller in a dual-channel, 3-terminal hookup, or from an external 24 V supply) is not possible, if the
two contacts are closed.
Such a short can be detected only when both of the contacts are open and the short is
present for at least 2 seconds.
XS/SC26-2 Safety Controller
68
