Safety and Standards
Performance Level vs SIL: Which One Applies to Your Robot
Two frameworks measure the same thing differently. ISO 13849 uses performance levels a to e, IEC 62061 uses SIL 1 to 3. Which to use, how they map, and what determines the target.
Both frameworks answer the same question: how reliable must this safety function be. ISO 13849-1 expresses the answer as a performance level from a to e, IEC 62061 as a safety integrity level from SIL 1 to 3. For machinery, including robot cells, the performance level route is more common in Europe. Both are acceptable, and the target is derived from the risk, not chosen by preference.
How the target is derived
Under ISO 13849-1 the required performance level comes from three parameters, assessed for each safety function separately.
- Severity of injury. S1 for slight and normally reversible, S2 for serious or irreversible including death.
- Frequency and duration of exposure. F1 for seldom to less often, F2 for frequent to continuous.
- Possibility of avoiding the hazard. P1 for possible under specific conditions, P2 for scarcely possible.
A robot cell hazard is typically S2, because an industrial arm can cause serious injury; F2, because operators interact regularly; and P2, because a fast arm cannot be avoided once motion begins. That combination lands on PL d, which is why so many robot safety functions carry that target.
| Performance level | Average probability of dangerous failure per hour | Approximate SIL |
|---|---|---|
| a | 10⁻⁵ to 10⁻⁴ | no correspondence |
| b | 3 x 10⁻⁶ to 10⁻⁵ | 1 |
| c | 10⁻⁶ to 3 x 10⁻⁶ | 1 |
| d | 10⁻⁷ to 10⁻⁶ | 2 |
| e | 10⁻⁸ to 10⁻⁷ | 3 |
What achieving a level requires
| Level | Typical architecture | Diagnostic coverage | Example function |
|---|---|---|---|
| b or c | Single channel with some monitoring | none to low | Non-critical interlock |
| d | Two channels with cross monitoring | medium to high | Protective stop, guard interlock |
| e | Two channels, high diagnostics, tested | high | Hazard with immediate fatal potential |
Beyond architecture, the calculation needs component reliability data, usually mean time to dangerous failure, the diagnostic coverage of the monitoring, and an assessment of common cause failure. Component manufacturers publish these figures precisely so integrators can perform the calculation.
The safety functions a robot cell typically has
Listing them explicitly, each with its own target and evidence, is what a complete file looks like.
| Function | Typical target | Sensor | Actuator |
|---|---|---|---|
| Emergency stop | PL d, cat 3 | Button contacts | Drive disable and contactors |
| Guard door interlock | PL d, cat 3 | Coded interlock switch | Drive disable |
| Protective stop from a scanner | PL d, cat 3 | Safety laser scanner | Safe stop function |
| Safe reduced speed in manual mode | PL d | Encoder, mode selector | Drive speed limitation |
| Enabling device in teach mode | PL d | Three-position switch | Drive enable |
| Safe zone or space limitation | PL d | Encoder based monitoring | Safe stop on violation |
| Contact force limitation | PL d | Joint torque sensing | Motion limitation |
| Brake monitoring | PL c or d | Encoder during test | Fault signal |
Each row needs its own derivation, its own calculation and its own validation record. Eight functions is a normal count for a guarded industrial cell, and a file with a single blanket statement covering all of them is the most common finding in a robot safety audit.
Where files go wrong
- A level asserted rather than derived. The severity, frequency and avoidance assessment is missing, so the target is an opinion.
- Architecture without calculation. Two channels do not automatically give PL d; the component data and diagnostic coverage decide it.
- The weakest element ignored. A function is only as good as its whole chain, sensor to logic to actuator. A PL e scanner feeding a single-channel relay is a PL c function.
- Software omitted. Safety-related software has its own requirements, and configurable safety controllers need their configuration validated.
- No validation. The calculation predicts; validation confirms. Fault injection testing is part of the obligation, not an optional extra.
Frequently asked questions
Do I need a performance level or a SIL?
Either is acceptable for machinery. In Europe the ISO 13849 performance level route is more common for robot cells; IEC 62061 SIL is more usual where the plant already works in process industry terms. What matters is that one is derived and evidenced.
What performance level do robot cells usually need?
PL d for most protective functions, because the typical assessment is serious injury potential, frequent exposure and scarcely avoidable hazard. Functions with immediate fatal potential can reach PL e.
Does a cell have a single performance level?
No. Each safety function is assessed and rated separately, and they routinely differ. A file quoting one level for the whole installation has not performed the analysis.
Do two channels automatically give PL d?
No. Architecture is one input; the calculation also needs component reliability data, diagnostic coverage and a common cause failure assessment. Two channels with poor diagnostics can fall short of PL d.
Is a calculation enough?
No. The calculation predicts the achieved level, and validation confirms the function behaves as specified including under fault conditions. Fault injection testing is part of the obligation.
Sources
- ISO 13849-1, safety-related parts of control systems, general principles for designInternational Organization for Standardization, performance levels and their derivation
- IEC 62061, functional safety of safety-related control systemsInternational Electrotechnical Commission, the SIL route for machinery
- ISO 10218-1:2025, Robotics, Safety requirements, Part 1International Organization for Standardization, functional safety requirements for robots