Every safety datasheet in the Schmersal catalogue quotes a Performance Level or a SIL figure — PL d, PL e, SIL 2, SIL 3 — and every machine builder has to pick a number before choosing components. Get the framework wrong and you either overspend on redundant architecture you do not need, or worse, under-spec a safety function that then fails an audit. This guide explains what SIL and PL actually measure, how the two standards differ, what the ISO 13849 categories mean, and how to map all of it onto real component selection.
1. What SIL and PL Actually Measure
Both SIL and PL are ways of quantifying how dependable a safety function is — the probability that it will perform correctly when it is needed to stop or reduce a hazard. The underlying metric is the probability of dangerous failure per hour (PFHd).
- SIL — Safety Integrity Level (IEC 61508 / IEC 62061): four discrete levels, SIL 1 to SIL 4, each covering a defined band of failure probability. SIL 4 is reserved for nuclear, rail and aerospace; machinery rarely needs more than SIL 3.
- PL — Performance Level (ISO 13849-1): five levels, PL a to PL e, built from four factors — the system architecture (Category), the diagnostic coverage (DC), the mean time to dangerous failure (MTTFd) and common-cause failure (CCF) measures.
The distinction is practical: SIL is the metric used in IEC 62061 for electrical/electronic/programmable systems and process industries; PL is the machinery-centric metric of ISO 13849-1 that also accommodates mechanical, pneumatic and hydraulic safety elements. For a standard machine with a safety relay and a door switch, you will usually work in PL. For a complex programmable safety PLC, you may work in SIL.
2. SIL vs PL: The Two Standards Compared
| Aspect | PL (ISO 13849-1) | SIL (IEC 62061) |
|---|---|---|
| Levels | PL a to PL e (five) | SIL 1 to SIL 4 (four) |
| Scope | All technologies (mech, pneumatic, hydraulic, electric) | Electrical / electronic / programmable only |
| Basis | Category + DC + MTTFd + CCF | PFHd / PFD, systematic capability |
| Typical use | Machinery safety circuits | Safety PLCs, process safety |
3. The Five ISO 13849 Categories: B, 1, 2, 3, 4
The Category describes the structural architecture of the safety-related control system — how faults are tolerated and detected. This is the most misunderstood part, because a component alone is never a Category; the Category belongs to the whole circuit.
- Category B — basic, single-channel, no diagnostics. A single fault can lose the safety function.
- Category 1 — well-tried components, single-channel. Higher reliability than B but still no fault detection.
- Category 2 — single-channel with periodic testing of the safety function.
- Category 3 — dual-channel redundancy; a single fault does not cause loss of the safety function, but the fault may go undetected until the next demand.
- Category 4 — dual-channel with continuous self-monitoring; a single fault is detected immediately and the safety function is maintained.
The practical consequence: a Category 3 or 4 architecture needs two independent channels. This is why a safety relay with dual-channel inputs — such as the Schmersal SRB-E-402EM-CC — is the foundation of most PL d / PL e circuits, rather than a single ordinary relay.
4. SIL and PL Mapping: How the Levels Correspond
The two scales overlap and can be approximately mapped. This table is the one engineers reach for when a customer asks for "SIL 2" on a machine built to PL.
| Performance Level | Corresponding SIL | PFHd (per hour) | Risk reduction |
|---|---|---|---|
| PL a | — (no SIL equivalent) | ≥ 10⁻⁵ | Low |
| PL b | SIL 1 | 3×10⁻⁶ – 10⁻⁵ | Moderate |
| PL c | SIL 1 | 10⁻⁶ – 3×10⁻⁶ | Medium |
| PL d | SIL 2 | 10⁻⁷ – 10⁻⁶ | High |
| PL e | SIL 3 | < 10⁻⁷ | Very high |
Note the mapping is approximate — a device listing both PL and SIL has been independently validated under each standard, and the final safety-function verification must still be done in the framework you are applying.
5. How a Risk Assessment Determines Your Required Level
You do not choose a level off a menu. The required Performance Level (PLr) or SIL comes from a risk assessment under ISO 12100, typically via the ISO 13849-1 risk graph, which weighs three factors:
- Severity of injury — S1 (slight, reversible) or S2 (serious, irreversible).
- Frequency and duration of exposure — F1 or F2.
- Possibility of avoiding the hazard — P1 or P2.
The combination places you on a scale from PLr = a (low) up to PLr = e (highest). A guard door on a slow packaging machine might land at PL c, while a robot cell with high-speed motion typically lands at PL d or PL e. The chosen components must then meet or exceed that PLr.
6. Selecting Components to Meet Your Level
Different safety functions map naturally to different component families, each available in a range of levels:
- Guard monitoring — a safety door switch or coded magnetic sensor, such as the Schmersal BNS 40S-12Z-C-LST, feeding a dual-channel safety relay achieves up to PL e / Category 4.
- Personnel protection — a safety light curtain, such as the SLC440AS-R-1930-30, provides PL e / SIL 3 class protection for hand and finger detection.
- Guard locking — a solenoid interlock, such as the AZM150SK-02/02RIA-024-B5, holds the guard closed and monitors the lock, for PL d / PL e guarding.
- Position monitoring — a modular limit switch with positive-opening contacts, such as the PS216-Z11-ST-R210, provides reliable position signals in Category 3/4 architectures.
- Long-distance e-stop — a rope-pull switch, such as the ZS 235-11Z-ST-3142-2, spans the length of a conveyor for emergency stop at any point.
Browse the Schmersal Safety Relays, Safety Door Switches and Safety Light Curtains categories to filter by the required PL and SIL rating for your application.
Frequently Asked Questions
What is the difference between SIL and PL?
SIL (Safety Integrity Level, IEC 62061/IEC 61508) and PL (Performance Level, ISO 13849-1) are two parallel scales that both express how dependably a safety function performs. SIL has four levels and is used for electrical/programmable systems; PL has five levels and is the machinery standard that also covers mechanical and pneumatic elements. They map approximately: SIL 1 ≈ PL c, SIL 2 ≈ PL d, SIL 3 ≈ PL e.
What is the difference between Category 3 and Category 4?
Both are dual-channel redundant architectures, but Category 4 adds continuous self-monitoring so a single fault is detected immediately and the safety function is maintained, whereas Category 3 detects the fault at the next demand. Category 4 is required for PL e applications.
Does a component rated PL e make my circuit PL e?
No. The Performance Level belongs to the whole safety function, not the component. The architecture, wiring, diagnostic coverage and the safety controller all contribute. A PL e component in a single-channel circuit will not deliver PL e — the full chain must be assessed.
How do I know if I need PL d or PL e?
The required level comes from your risk assessment (ISO 12100 and the ISO 13849-1 risk graph), weighing injury severity, exposure frequency and avoidance possibility. Serious, hard-to-avoid hazards in high-speed machinery typically demand PL d or PL e; simpler, avoidable hazards may only need PL c.
Conclusion
SIL and PL are two dialects for the same question: how sure are you that the safety function will work when it matters. Understanding the categories, the standards and the mapping is the prerequisite to selecting components that are neither under- nor over-specified. With a dual-channel safety relay, a coded sensor, a light curtain or a guard lock matched to the required level, the Schmersal range lets you build a certified safety function at every point from PL c to PL e — and document it with confidence.