The manufacturer must analyse the machinery’s risks, ensuring that it meets the applicable essential safety requirements. If necessary, they must initiate the risk reduction process, defining the necessary safety measures to contain or eliminate the risk. When the adopted measure involves electrical components of the machinery’s control system, their contribution to risk reduction can be quantified through the Performance Level (PL). By calculating the performance level of the associated safety function, the manufacturer can determine whether a technical solution sufficiently reduces the risk.

The harmonised standards related to the Performance Level (PL) are:

• EN ISO 13849-1 Safety of machinery – Safety-related parts of control systems – Part 1: General principles for design

The Performance Level (PL) defines the ability of a function to perform its safety role under normal operating conditions and in the event of a fault. The latter aspect is particularly crucial, as a fault that compromises the effectiveness of a protective measure can expose individuals to risk. The Performance Level (PL) is determined by quantifying the average frequency of a dangerous failure per hour (PFH), which is the formally used abbreviation. There are five levels, ranging from PL a, which provides a low contribution to risk reduction, to PL e, which offers a high contribution to risk reduction. A higher contribution means a lower probability of a dangerous failure occurring.

The performance level considers only dangerous failure —those that could actually expose people to risk. A fusing of the contacts in a safety switch is clearly an undesirable failure: if it maintains continuity in the activated movement, the failure is dangerous, whereas if it results in a stop, it is safe. A failure that stops the hazardous movement cannot, in any way, endanger people’s health and therefore should not be considered in this context.

SRP/CS stands for “safety-related part of control system,” referring to the part of a control system that responds to safety-related input signals and generates safety-related output signals. This term is frequently used to denote the devices involved in the machinery’s safety functions—those that factor into the performance level calculation. Conversely, devices that perform purely functional operations, whose failure cannot affect the machinery’s safety, are naturally excluded.

The machinery’s performance level refers to that of each of its safety functions, not of the individual devices installed. While the performance level of individual devices can certainly influence the function’s overall performance level, it does not account for the interconnections between subsystems, which may still affect the machinery’s reliability.

A safety function involves three types of subsystems:

• Input Subsystem: Safety devices that intervene in emergencies, such as interlocking devices, emergency stop buttons, electro-sensitive protective devices, and bumpers.
• Logic Subsystem: Devices that process the safety signal from the input, direct it to the output devices, and monitor whether a shutdown has occurred, such as relays or safety PLCs.
• Output Subsystem: Devices that receive the signal from the logic and stop the hazardous condition, such as relays, valves, safety-related power drive systems (e.g., STO – Safe Torque Off).

The connection of these three subsystems constitutes the safety function.

Installing a high-performance safety component or subsystem without considering the other elements involved in the function may leave the overall performance level of the function unchanged. Devices with low performance and improper connections can downgrade the performance of the entire safety function. For instance, installing high-performance safety inputs (such as photoelectric barriers) in outdated machinery with poor safety performance may not result in a real improvement in the machinery’s overall performance. In some cases, the intervention may even prove to be essentially useless.