What does an EN ISO 13849-1 performance level mean in hydraulic control?
EN ISO 13849-1 defines the performance level per function: detection, logic and output are assessed together, and the hydraulics belong to that chain.
EN ISO 13849-1 gives the method for determining and validating the performance level (PL) for the safety-related parts of a control system; it applies to electrical, hydraulic, pneumatic and mechanical technologies alike. That is why it matters in hydraulic control. The critical distinction is this: PL is a property of a function, not a label on a single component.
PL is defined per function
PL is a scale expressing how reliable a safety function is against failure. The statement "this remote control is PL d" is technically incomplete; what is assessed is an entire chain such as the "emergency stop function" or the "stop the lifting motion function": detection, logic processing and output. EN ISO 13849-1 requires these three links to be assessed together within the same function.
| Link in the chain | What it corresponds to in hydraulic control | The point most often skipped |
|---|---|---|
| Detection | Button, joystick, limit switch, position feedback | With single-channel detection there is no fault detection |
| Logic | Control card, relay logic, safety module | Which position the output falls to when the supply is cut |
| Output | Valve coil, spool, piping, cylinder | If the spool sticks, the movement continues even though the power is cut |
Why the hydraulics are inside the chain
The chain that stops a motion also includes the valve, the piping and the cylinder. Even if the valve returns to centre when the power is cut, load inertia or a leakage path can keep the movement going. For that reason how the hydraulic motion stops on an emergency stop has to be demonstrated separately; the electrical command having been cut is not on its own considered sufficient.
For context: ISO 13850 requires at least PLr c for the emergency stop function; PLr d or e is expected where the risk assessment calls for it. In Category 2 architecture, fault detection is provided only by checks carried out during operation at suitable intervals; PL d and Category 3, on the other hand, require a single fault neither to lose the function nor to go undetected.
A component on its own does not give a PL
This information is given as a general engineering framework. The PL level a machine will reach is determined by that machine's own risk assessment and by evaluating all the components in the chain together. A declaration of conformity for a product shows its conformity with the directives listed in that declaration; reading this directly as "my machine has reached such and such a PL level" is wrong. In the same way, a remote control carrying an emergency stop button does not mean that the emergency stop function on that machine has reached the intended level. The place of a wireless remote control in the chain is assessed separately as well; whether wireless emergency stopping is sufficient on its own depends on the risk assessment of the machine.
What to do in practice
On a hydraulic machine, begin by drawing up a list of functions: which movements have to be stopped, in which situation and within what time? For each function write out the detection, logic and output chain one by one; include the hydraulic side in that list as well. The required PLr is set by the risk assessment, and the choice of components comes after that. This assessment is made by the person responsible for the machine or by an authorised engineer; it is not a value to be read off a component catalogue.
The full topic: HCT402 technical review: what, how and how much