Define the function before selecting components
The specification must identify the hazard, condition triggering the response, expected safe state and operating modes affected. Response time, resetting and the conditions for restarting also matter.
Saying that a machine needs a safety stop is insufficient. Specify which movement stops, which energy sources remain and how exposure is prevented before the intended state is reached.
What PL and required PL mean
Performance level, or PL, characterises the ability of safety-related parts of a control system to perform a function under foreseeable conditions. The required performance level, PLr, is determined for that function from the risk assessment and applicable requirements.
ISO 13849-1:2023 provides a design and integration methodology. Its public scope explains that it does not prescribe safety functions or PLr for individual applications: there is no universal level for every machine.
Assess the complete chain
A function usually includes input devices, logic and output elements. Sensors, control and actuators must be analysed together with their interfaces and actual conditions of use.
Architecture, component reliability, diagnostic capability, common-cause failures and systematic errors influence the result. Buying a relay or controller with specified performance does not automatically establish the performance of the installed system.
Verification and validation
Verification compares the design and its calculations with the specification. Validation checks, through appropriate analysis and testing, that the implemented function satisfies the intended requirements, including relevant failures and operating modes.
INSST Technical Prevention Note 946 explains these technical foundations. When using it, consider its publication date and check the applicable standard editions; an older guide does not establish that all its references remain current.
What to request when purchasing or modifying machinery
Obtain the specified functions, risk criteria used, design documentation, validation results and instructions for maintenance and checks. The scope must match the machine or assembly actually supplied.
Changing sensors, programs, guards or stopping times can alter the function. Before returning equipment to service, assess the effects and document the necessary checks with competent personnel involved.
Limits of functional safety
Royal Decree 1215/1997 requires suitable equipment and measures addressing its risks during use. Control-system safety does not replace safe design, guards or energy control during maintenance.
PL is not overall machine certification or a cybersecurity assessment either. This article guides documentary review; designing and calculating a function requires specific technical knowledge.
Hypothetical example: an access door
A company installs an interlocked door on a cell. The review finds that opening it commands a stop, but hazardous movement continues for a time and can be reached before stopping.
The technical team reviews the function, access and complete response. Validating only that the switch changes state would have left actual protection of the person unchecked.
