1. What Is ISO 13849 Safety-Related Control-System Design?
ISO 13849 Safety-Related Control-System Design is a functional-safety engineering methodology for designing and evaluating the control-system elements that perform a machine’s safety functions. It addresses whether those functions can provide the required protection despite faults. ISO is the short name of the International Organization for Standardization; 13849 identifies the standards series.
For manufacturers of industrial machinery, the central question is specific: can the complete chain—from a guard sensor through control logic to the device controlling hazardous motion—deliver the required safety performance? Executives use the approach to structure engineering investment, supplier requirements, machine-release decisions, and retrofit priorities.
This is a technical standards-based methodology, not a general strategy framework. Consultants can organize the assessment and implementation program, but competent machinery-safety engineers must perform the technical design and validation.
2. Origin and Background
The framework was developed through ISO’s machinery-safety standardization process, associated with Technical Committee ISO/TC 199, rather than invented by an individual management thinker. The first edition of ISO 13849-1 was published in November 1999.
The 2006 revision combined established control-system architecture categories with quantitative failure assessment through the concept of a Performance Level. This evolution addressed technologies, including electronics and software, that required more than an architecture-only assessment. Practical guidance and tools from the German Social Accident Insurance’s Institute for Occupational Safety and Health, known as IFA, support implementation.
This article uses ISO 13849-1:2023, the fourth edition, and ISO 13849-2:2012, covering validation, as reference points. Project teams should confirm the editions and national adoptions applicable to their equipment, contracts, and destination markets.
3. How ISO 13849 Safety-Related Control-System Design Works
Define the protection required
The unit of analysis is an individual safety function, not an entire factory or machine model. Examples include preventing hazardous motion while a guard is open or stopping motion following protective-device activation. Each function needs a specification covering its trigger, safe state, response time, operating modes, interfaces, and required Performance Level, abbreviated PLr.
PLr follows from the applicable machinery requirements and risk assessment. ISO 13849’s risk-graph approach considers injury severity, frequency or duration of exposure, and the possibility of avoiding harm. Relevant machine-specific standards must also be considered; the general standard does not prescribe one universal PLr for every application.
Demonstrate the performance achieved
The achieved Performance Level, or PL, ranges from a to e. Higher levels correspond to lower dangerous-failure frequencies, subject to the associated technical requirements. Evaluation combines architecture, component reliability, fault detection, and other design measures—not simply the presence of a safety-rated controller.
| Category | Simplified architectural meaning |
|---|---|
| B | Basic safety principles; a fault can cause loss of the safety function. |
| 1 | Well-tried components and principles improve reliability, but a fault can still defeat the function. |
| 2 | Testing checks the function at appropriate intervals; failures can occur between checks. |
| 3 | A single fault does not cause loss of the function, although some faults can remain undetected. |
| 4 | More stringent fault detection and fault-accumulation requirements preserve the safety function. |
Categories B, 1, 2, 3, and 4 describe structure and fault behavior. They are not interchangeable with Performance Levels: architecture alone does not establish the achieved PL.
The principal reliability inputs include MTTFd, mean time to dangerous failure; DCavg, average diagnostic coverage; and measures against CCF, common-cause failure. These distinguish reliable components, effective fault detection, and protection against events that defeat multiple channels together.
Assessment covers the complete safety-related control chain, including electrical, hydraulic, pneumatic, or mechanical elements where relevant. Software and systematic design failures also require attention. A favorable numerical calculation cannot, by itself, establish that the function behaves correctly on the installed machine.
4. When to Use ISO 13849 Safety-Related Control-System Design
Use the methodology when developing an equipment platform, integrating a production cell, changing safeguarding, replacing control hardware, or evaluating a substantial retrofit. It is particularly useful for industrial automation projects where several suppliers contribute parts of one safety function.
The business questions include: which functions require redesign, which supplier claims need supporting evidence, which machine variants can share an assessed subsystem, and what must be completed before commissioning?
Required inputs normally include risk assessments, circuit diagrams, component reliability data, operating cycles, software configurations, and validation evidence. Engineering, maintenance, operators, safety specialists, and integrators should contribute. The effort depends less on an executive workshop than on documentation quality, system complexity, and access for testing.
The approach is especially powerful when comparing alternative architectures against a defined requirement. It is not a general uptime model or a substitute for whole-machine risk assessment. ISO 13849-1:2023 addresses high-demand and continuous operation, not low-demand safety applications. Missing duty-cycle information or incomplete system boundaries can invalidate the analysis.
5. How to Apply ISO 13849 Safety-Related Control-System Design: Step-by-Step
- Clarify the decision and scope.
State whether the project concerns product release, cell integration, or installed-equipment remediation. Define machine boundaries, operating modes, variants, intended service life, destination markets, and the accountable engineering owner.
- Gather evidence from the actual configuration.
Collect hazard assessments, drawings, supplier safety manuals, reliability data, software versions, and maintenance records. Observe production, changeovers, and jam clearing; do not build the assessment solely from nominal automatic operation.
- Specify each safety function.
Create a requirements register. For each function, record the initiating event, required safe state, permitted response time, PLr, active modes, and interfaces. Keep the relationship to the underlying hazard explicit.
- Construct the architecture and evaluation model.
Map inputs, logic, outputs, channels, and diagnostics. Document supplier-data assumptions. An appropriate tool, such as IFA’s SISTEMA—Safety Integrity Software Tool for the Evaluation of Machine Applications—can support architecture modeling and reliability calculations.
- Interpret results and validate behavior.
Compare achieved PL with PLr, then examine qualitative requirements and interfaces. Plan analysis and controlled testing of normal operation, relevant faults, timing, and restart behavior. Validation is necessary; a calculation report is not the complete evidence package.
- Translate gaps into an implementation program.
Assign redesign, supplier qualification, software correction, documentation, and testing work. A product safety compliance program can establish accountable remediation plans and release criteria across equipment families.
- Test sensitivities and alternatives.
Reassess uncertain cycle rates, component substitutions, diagnostic assumptions, and service-life expectations. Compare feasible designs, but do not lower the required protection merely to fit a budget.
- Align stakeholders and preserve the evidence.
Review conclusions with engineering, operators, maintenance, quality, and the integrator. Resolve disputed assumptions. Define which hardware, software, operating-mode, or application changes trigger renewed assessment and validation.
6. Example: ISO 13849 Safety-Related Control-System Design in Action
Illustrative scenario: Riverton Assembly Systems, a fictional equipment builder, is adapting a servo-indexed assembly cell for a customer with more frequent production cycles. The cell includes guarded access for clearing component jams.
The team selects the guard-interlocking function as one assessment unit: hazardous indexing and conveyor motion must be inhibited while the access guard is open. Its documented assessment establishes PLr d for that function. This target is illustrative, not a universal requirement for assembly cells.
Engineers examine the guard device, logic, stopping outputs, diagnostic feedback, and expected operating cycles. The original proposal relies heavily on the controller’s supplier rating, but the output arrangement lacks evidence supporting the complete function’s target.
The team redesigns the output architecture and feedback monitoring, updates the reliability model, and validates the installed behavior. A separate guard-locking function prevents access before hazardous motion has ceased and receives its own assessment.
Management approves release only after the required evidence is complete. Riverton then controls the module’s permitted configurations, documents application limits, and requires review of replacement components. The commercial benefit is a repeatable engineering process—not an unsupported promise of fewer injuries or higher uptime.
7. Strengths and Limitations
Strengths
- Clear requirements: It connects a defined protective function with an explicit performance target.
- Comparable design choices: Teams can assess alternative architectures rather than defaulting to the highest-rated component.
- Structured evidence: Requirements, calculations, and validation support a reviewable engineering decision.
For equipment builders, embedding supplier qualification, release checks, and configuration control into quality management turns the assessment into a repeatable product-development discipline.
Limitations
ISO 13849 does not identify every machine hazard or provide comprehensive cybersecurity measures. It also cannot compensate for incomplete application assumptions or ineffective physical safeguards. Whole-machine risk assessment and other applicable requirements remain necessary.
In the United States, this methodology does not replace applicable OSHA guarding and hazardous-energy-control requirements. A safety stop must not be treated as a substitute for required energy isolation during servicing.
8. Common Pitfalls and How to Avoid Them
- Buying a rating instead of assessing a function. A subsystem claim does not establish the complete chain’s performance. Evaluate all relevant elements and interfaces.
- Using optimistic cycle assumptions. Nominal production data can overlook frequent switching or intervention. Use defensible operating profiles and test uncertain inputs.
- Equating two channels with independence. Shared vulnerabilities can undermine redundancy. Examine common-cause failures rather than counting channels.
- Ignoring setup and jam clearing. Automatic-mode analysis can miss intervention hazards. Specify protection for relevant modes and consider incentives to defeat safeguards.
- Allowing uncontrolled substitutions. A replacement component or software revision may invalidate evidence. Require documented change review and appropriate revalidation.
9. How ISO 13849 Safety-Related Control-System Design Relates to Other Frameworks
Before: ISO 12100 risk assessment
ISO 12100 establishes the broader machinery risk-assessment and risk-reduction process. Use it first to identify hazards and determine protective measures. ISO 13849 then addresses the control-system functions supporting those measures; it should not become an excuse to solve every hazard through controls.
Alongside: failure analysis
Failure Mode and Effects Analysis, or FMEA, examines individual failure modes and their effects. Fault Tree Analysis, or FTA, examines combinations leading to an unwanted event. Both can expose weaknesses in a proposed safety architecture, but neither replaces ISO 13849’s performance evaluation and validation requirements.
Alternative: IEC 62061
IEC 62061, published by the International Electrotechnical Commission, provides another machinery functional-safety approach, using Safety Integrity Levels, or SILs. Select the approach based on applicable machinery requirements, available subsystem evidence, and engineering competence. Do not treat PL and SIL as interchangeable labels without the appropriate technical assessment.
10. Key Takeaways
- Assess individual safety functions, not a machine-wide rating.
- Establish required protection before selecting the architecture.
- Evaluate the complete control chain, including its interfaces.
- Pair calculations with qualitative assessment and validation.
- Preserve the evidence through controlled equipment changes.
11. FAQs About ISO 13849 Safety-Related Control-System Design
Is ISO 13849 the same as machine reliability management?
No. It addresses dangerous failures of safety-related controls, not general production availability. A machine can have excellent uptime while its protective functions remain inadequately supported.
Can smaller equipment manufacturers use it?
Yes. Start with a clearly bounded machine and function register, obtain reliable supplier evidence, and engage competent specialists where needed. Reusable documentation can reduce effort, but reuse must respect application limits.
Does a safety-component certificate prove the machine complies?
No. It can support the evidence for a component or subsystem, but the complete safety function still requires assessment and validation in its actual configuration. Supplier documentation is an input, not a substitute for integration evidence.
