But with the adoption of the European Union’s new Machinery Directive, and its switch from EN 954 to ISO 13849, there is increasing interest among manufacturers in establishing Performance Levels for their products and systems.
For this reason, it is a good time to look closely at how these safety levels compare. One way to start a comparison of PL and SIL is to look at what they have in common—how they are satisfied. This is the probability of failure. In both PL and SIL (if applied to machinery control systems), it is expressed in probability of failure per hour (PFH). Further, both ratings have requirements concerning structure, the degree of self-detection built into a device, and the confidence that design faults have been avoided (called “systematic capability” in IEC 61508).
The essential difference between PL and SIL is rooted in the parameters that express the degree of fault detection, the degree of redundancy, and the degree of reliability. The PL not only has a PFH, but also a reliability value for each channel inside the safety-related system. This is called the mean time dangerous to failure (MTTFd) of a channel.
The PL also strives to ensure that a certain performance level is not just a matter of reliability calculations. In fact, the PL limits the MTTF. The largest MTTF that can be claimed for a channel is 100 years in PL calculations; even if you have reliability figures that are better than 100 years, you are not allowed to consider them beyond that figure.
“The data that you use to do these calculations are approximate anyway, and no one wants to hear of a mean time to failure of 10,000 or 100,000 years for a single channel safety-related system,” says Thomas Maier, principal engineer, functional safety, at UL.
To Be or to Convert
In principal, both PL and SIL have the same types of parameters: one that expresses reliability, one that expresses structure, and another that expresses the degree of self detection (i.e., the diagnostic coverage of safe failure fraction). The formulas are slightly different, but not remarkably so. Some of the results for an SIL can be used for a PL, and some of the results for a PL can be used for an SIL.
If you have a certain SIL and know the parameters that have gone into achieving it, then you can very easily translate the SIL into a PL. Further, if you know the structure—described in IEC 61508 as “one out of one” or “one out of two”—it can be mapped into the categories of a PL.
Performance Levels are only referenced in one standard, ISO 13849. Safety Integrity Levels are referenced in IEC 61508 and all the other standards derived from it. But ISO 13849 is pivotal because of its role in the new Machinery Directive, so it is quickly making EN 954 obsolete, along with the safety “categories” referenced in EN 954. The latter are being replaced by Performance Levels. “If you are accustomed to EN 954, your best choice would be to use ISO 13849 and go for a PL, because it will be easier to understand and implement,” says Maier.
Kevin Connelly, business development manager at UL, says that it is important to consider your product’s market before choosing to rate your product with a PL or SIL. PL is used more often in the machine industries, while SIL is more prevalent in the process industries. “At this time, we still have the two standards, ISO 13849 and the SIL-based IEC 62061,” says Maier. “Some customers prefer the SIL, while others prefer the PL; nevertheless, it’s best for manufacturers to seek certification for both SIL and PL. It doesn’t increase the cost considerably, perhaps only 10 to 15 percent, because they are closely related; but, having both opens up markets in terms of function and geography.”
Because of the Machinery Directive, PL certification is particularly important for those selling into the EU. Regardless, having both PL and SIL results in a product that will be acceptable globally.
The Emerging Merge
There are ongoing efforts to merge PL and SIL into a single standard. Currently, a technical report compares ISO 13849 and IEC 62061—implicitly comparing PL and SIL—and concludes that there is a high degree of correspondence between the two. “This technical report is the first step toward merging the two standards into one,” says Maier. “That should happen within a couple of years.”
For more information on the use of PL and SIL as performance measures for functional safety, or for more information on how UL can help your company with any functional safety issue, please contact:
Kevin Connelly
631-546-2691
[email protected]
Or visit us on the web at: www.ul.com/functionalsafety.
