EN ISO 13849 is a series of standards for machine safety in the field of Functional Safety from machine controls. Application of DIN EN ISO 13849. It describes requirements for safety-related parts of controls, i.e., control parts that perform safety functions. This includes sensors, logic, actuators, and the associated software.
Content
What is ISO 13849?
EN ISO 13849 addresses safety-related parts of control systems for machinery. The first part, EN ISO 13849-1, contains general design principles. The second part, EN ISO 13849-2, describes the validation process.
The standard is used for controls that mitigate risks on machines through technical protective measures. For example, a safety function can be triggered when a light curtain is interrupted. The control must then execute a specified reaction, such as stopping a hazardous movement.
The standard considers the safety-related part of the control system as a chain of input, processing, and output. Inputs can come from position switches, light curtains, or interlocks. Processing can occur in a safety controller. The output acts on contactors, valves, drives, or other actuators.
Structure of the standard
EN ISO 13849 consists of two parts:
- EN ISO 13849-1: general principles for the design of safety-related parts of control systems
- EN ISO 13849-2: Validation of safety-related parts of control systems
Part 1 was revised in 2023 in a fourth edition. The revised version more strongly organizes the content along the development process: specification of safety functions, design of safety-related control parts, determination of the achieved Performance Level, software requirements, validation, documentation, and user information.
The validation requirements, previously in Part 2, have been incorporated into Part 1 in the 2023 edition. Part 2 remains as a validation standard until further revision is completed.
Fundamentals of EN ISO 13849
The application begins with the risk assessment of the machine. From this, a required Performance Level, PLr, is derived for each safety function. The Performance Level describes the contribution of a safety function to risk reduction. The levels range from PL a to PL e.
The PLr can be determined using a risk graph. Three risk parameters are considered:
- Serious potential injuries (S)
- Frequency or duration of hazard exposure (F)
- Possibility to avoid the danger or limit the damage (P)
After setting the PLr, the safety function is specified. The 2023 edition requires a more detailed description for this. This includes, among other things, the triggering event, the required reaction, the PLr, the permissible response time, active operating modes, interfaces to other control functions, behavior during power loss, and conditions for restart.
Subsequently, the safety function is implemented technically. For this purpose, a safety-related part of a controller, an SRP/CS, can be divided into subsystems. A typical division is into input, logic, and output. For each subsystem, the properties that contribute to the achieved Performance Level are determined.
These properties include:
- Categories of Architecture
- Mean time to hazardous failure
- Diagnostic coverage
- Measures Against Common Cause Failures, CCF
- Measures against systematic errors
- mean frequency of a dangerous failure per hour, PFH
The achieved performance level must at least meet the required PLr. A purely structural assessment is not sufficient for this. EN ISO 13849 combines architectural requirements from the earlier EN 954-1 with quantitative parameters, as known from functional safety.
Software according to EN ISO 13849
EN ISO 13849 also addresses safety-related software. The sources distinguish two types:
SRASW is safety-related application software. It typically runs on certified safety hardware and is often developed using languages with a restricted feature set. These include programming languages compliant with IEC 61131-3, such as contact diagram or function block language.
SRESW is security-related embedded software. It is embedded in a device or component and is more likely to be created with general-purpose languages.
For safety-related software, the standard describes a V-model. On the left side are specification, system design, module design, and coding. On the right side are module tests, integration tests, verification, and validation. For simple application software with validated function blocks, the 2023 release may provide a simplified two-stage model.
For SRASW, EN ISO 13849 requires, among other things, a software specification, a structured design, programming guidelines, testing, verification, documentation, configuration management, and change management. For higher requirements, additional measures are included, such as control and data flow analyses, limit value analyses, or higher requirements for the independence of verification and validation.
Software quality is not determined by a calculated probability of software failure. It is justified by the implemented measures for error prevention and error management.
EN ISO 13849 is used for machine controls when control functions contribute to risk reduction. The standard applies to different technologies, such as electrical, hydraulic, pneumatic, and mechanical control parts.
Application areas include, but are not limited to:
- Locking devices
- non-contact protective devices such as light curtains
- Two-hand control devices
- Security controls
- Relays and contactors
- Position switch
- Consent switch
- Drive controls with safety functions
- Security electronics in general
The standard is intended for controls with a high or continuous demand rate. According to the definition given in the sources, a high demand rate exists when a safety function is demanded more often than once per year. For controls with a low demand rate, the 2023 edition refers to the standard series. EN 61508.
Hardware Categories
The term Category, often referred to as Cat. B, 1, 2, 3, or 4, describes the fundamental hardware and system architecture of a safety-related control. It answers the question: How does the safety function behave in the event of failures in hardware, sensors, logic, or actuators? The Category is therefore an architectural proposal for hardware systems.
| Category | Basic principle | Typical Hardware Architecture | Error behavior | Diagnose |
|---|---|---|---|---|
| Cat. B | Fundamental Security Principles | single-channel | A single error can lead to the loss of the safety function | No diagnosis required |
| Cat. 1 | Proven components and principles | single-channel with higher reliability | A single error can still lead to loss, but is less likely | No diagnosis required |
| Cat. 2 | Testing the safety feature | mostly single-channel with cyclical testing | Errors can go undetected between two tests | Test function required |
| Cat. 3 | Redundancy with diagnostics | bichannel | A single error usually does not cause the loss of the safety function | Diagnosis required, but not every error is detected |
| Category 4 | Redundancy with high diagnostic coverage | dual-channel with high error detection | A single mistake does not lead to loss; accumulation of errors is controlled | high diagnostic coverage required |
The following describes categories 2-4. Cat. B and Cat. 1 are typically not implemented by electronic systems
Category 2: Testable Hardware
Category 2 supplements the single-channel architecture with a test function. The safety function is tested cyclically or event-driven. Therefore, a fault is not permanently compensated by redundancy, but detected by testing.
A typical hardware example is a single-channel shutdown chain whose output is regularly checked by a test unit. The ratio between the test interval, demand rate, and fault reaction time is critical here. If a dangerous fault occurs shortly after a test, it can remain undetected until the next test.
For embedded hardware, Cat. 2 often means that diagnostic paths, readback signals, watchdog concepts, output tests, plausibility checks, and defined error responses must already be considered in the hardware architecture.
Cat. 3: Dual-channel hardware with diagnosis
Category 3 is the typical entry point into redundant hardware architectures in many machine controls. The safety function is designed so that a single fault typically does not lead to the loss of the safety function.
A two-channel structure is typical:
Sensor A → Logic Channel A → Shut-off Path A
Sensor B → Logic Channel B → Shut-off Path B
The two channels must be sufficiently independent. Additionally, Cat. 3 requires diagnostic measures, for example, short-circuit monitoring, return circuit monitoring, plausibility comparison, test pulses, or status feedback from contactors and power drivers.
Important: Cat. 3 does not automatically mean that every fault will be detected. The safety function is usually maintained in the event of a single fault, but certain fault combinations or hidden faults can become critical if the diagnostics are insufficient.
Category 4: Dual-channel hardware with high diagnostics and error handling
Category 4 is the strictest category within the ISO 13849 architectures. Typically, dual-channel operation is also used here, but with higher diagnostic coverage and stronger control over fault accumulation.
In Cat. 4, the safety function must also be maintained in the event of a single fault. In addition, faults must be detected in a timely manner so that dangerous faults do not accumulate unnoticed. This leads to more sophisticated diagnostic and monitoring structures in the hardware.
Properties and Parameters
EN ISO 13849 works with Performance Levels. The required Performance Level is called PLr. The achieved Performance Level results from the design and evaluation of the safety-related control part.
The categories describe the architecture and behavior in case of faults. They are derived conceptually from EN 954-1, but are combined with quantitative and qualitative requirements in EN ISO 13849.
MTTF_D describes the mean time to dangerous failure of a channel. DC describes the proportion of dangerous failures detected by diagnostics. CCF measures are intended to prevent multiple channels from failing due to the same cause. PFH describes the mean frequency of a dangerous failure per hour.
The 2023 output creates a stronger distinction between SRP/CS and subsystems. An SRP/CS performs a complete safety function. Subsystems take on partial functions within this chain. An SRP/CS can include subsystems of different categories or integrate subsystems classified according to other functional safety standards.
Distinction from related standards and guidelines
EN 954-1 was the predecessor standard for safety-related controls and worked with categories. EN ISO 13849 has expanded this approach. It retains the categories but supplements them with parameters such as MTTF_D, DC, CCF, and PFH.
EN IEC 62061 is also a standard for safety-related machine controls. It uses Safety Integrity Levels, SIL. The 2023 edition of EN ISO 13849 describes in more detail how subsystems with SIL classification can be integrated into safety functions according to EN ISO 13849.
EN 61508 is a basic standard for functional safety. EN ISO 13849 refers to it, among other things, for control systems with a low demand rate and for certain software or subsystem aspects.
EN ISO 12100 It covers risk assessment and risk reduction for machinery. EN ISO 13849 is used within this process for risk reduction through safety-related control functions.
The Machinery Directive 2006/42/EC contains basic safety and health protection requirements. Annex I requires, among other things, that controls are designed and built in such a way that hardware or software defects do not lead to hazardous situations. EN ISO 13849 provides a technical evaluation and design method for safety-related control parts for this purpose.
