In November 2024, a roller conveyor line built in Guangdong arrived at the Port of Rotterdam. Customs pulled it for inspection, and the shipment never left the port. The manufacturer's first instinct was to check the CE certificate - it was fine, fully valid. The real problem sat inside the technical file: the risk assessment demanded PLd for the safety-gate interlock, but the machine had been built as a single-channel Category 2 architecture. The SISTEMA calculation report was also out of date and no longer matched the required PL in the documents. Rectification took two months. Between port storage fees and flying engineers back and forth, the cost could have bought another short conveyor line outright.
I have spent twenty years on the front lines of US warehousing - running operations, selecting equipment, and sitting across the table from notified bodies more than once. "PL mismatch" is the recurring failure mode I see in Chinese automation builders exporting to Europe. A certificate can be bought. A broken calculation chain gets spotted in minutes. So let me lay out what actually matters in EN ISO 13849: how a Performance Level gets set, where conveyors and AMRs diverge, and the rectification items reviewers flag most often.
Where the PL actually comes from
PL - Performance Level - runs from a to e and measures the probability of dangerous failure per hour. The further along the alphabet, the higher the reliability demand. Setting it is a two-step process: first determine the required PL, the PLr, then calculate what you can actually achieve.
The PLr comes from the risk assessment. That is non-negotiable. Start by identifying every safety function - on a conveyor line, that is usually the emergency stop, safety-gate interlocking, and area guarding, plus light curtains wherever people routinely enter. Then assess each function on three axes: how severe the injury could be, how often people are exposed, and how likely they are to avoid the hazard. Those three dimensions intersect to give you the PLr. In practice, the safety functions on a typical conveyor line land somewhere in the PL b to PL d band.
What you can actually achieve is decided by three inputs: MTTFD (mean time to dangerous failure), DCavg (average diagnostic coverage), and CCF (common-cause failure, scored on the well-known 65-point checklist). Those three numbers, together with the architectural category - Category B, 1, 2, 3, or 4, with higher numbers demanding more redundancy and diagnostics - determine which PL you can legitimately claim. Reaching PLd generally means a dual-channel architecture starting at Category 3; a single-channel Category 2 build will not carry a PLd claim. The Rotterdam shipment died exactly on that mismatch: PLd on paper, Category 2 in steel. The reviewer did not even need to read the calculation report closely.
When you are unsure about a clause number, write "per the standard text" instead of inventing one. And watch the editions: EN ISO 13849-1 was republished as a revised edition in 2023, while Part 2, covering validation, is still the 2012 edition. I have seen files that cited 2012 clause numbers in documents written against the 2023 edition - they came back with red ink all over them.
For the calculation itself, SISTEMA is the industry-standard tool. It is not magic: you feed in each component's MTTFD, your estimated DCavg, and your CCF checklist score, and it computes the achieved PL per safety function using the standard's method. The software is the easy part. The hard part is the provenance of every number you type in - a component's MTTFD has to trace back to the manufacturer's manual, a B10d conversion, or the reference tables in the standard's annexes. "The supplier told us this safety relay lasts a hundred years" is not evidence, and a reviewer will treat it as zero.
A minimal example shows how the arithmetic behaves. Take a safety-gate interlock: two door switches in series as input, a safety relay as logic, two contactors in series as output. Pull each component's MTTFD from its manual or a B10d conversion, estimate DCavg for the dual-channel setup with cross-monitoring, and score the CCF checklist item by item. Four numbers in, SISTEMA runs, the PL comes out - and if any one number lacks a source, the whole function collapses.
Conveyors and AMRs play by different rulebooks
A conveyor is general-purpose machinery, and the 13849 route works fine. An AMR is different. The complete machine also falls under product-specific type-C standards - ISO 3691-4, for example - which carry their own requirements for safety function levels. Where those exist, the product standard and the notified body decide the level. Do not invent absolute claims like "an AMR must reach PL d" in your documentation; if you write it, you have to prove it.
I have seen bid documents from Chinese builders declaring "this AMR's safety system achieves PLd" with total confidence, when the product standard asked for something else entirely for that function - or when the laser scanner's certification simply did not cover the application. Write the number too high and the burden of proof is entirely yours. Write it too low and the product standard trips you up. The correct sequence: read the product-specific standard first, confirm whether each safety function is graded there, and only then use 13849 to cover what the product standard leaves out. The two standards complement each other; they are not alternatives.A 2023 case made this concrete. A Shenzhen AMR builder had a fully certified laser scanner - but the certificate's intended use was fixed-area guarding. On a mobile robot doing follow-me guarding, the notified body rejected it. The fix was swapping in a scanner whose certification scope covered mobile use and redoing whole-machine validation. The project slipped three months. A certified component is not a correctly applied one: every word of the certificate's scope has to match your operating conditions.
One background shift to track: the old Machinery Directive was 2006/42/EC, and the EU Machinery Regulation (EU) 2023/1230 is replacing it, with full application in 2027 per the regulation text. For any new project, confirm with your issuing body whether the certification path sits under the directive or the new regulation - do not discover a mismatch the week before shipment.
The fixes I see over and over - and how to dodge them
The first and most common killer is a broken document chain. Four documents telling four stories: the risk assessment says PLr = c, the safety function list says the e-stop is PLr = d, SISTEMA computes PLc, and the validation report is copied from another project's template. A reviewer who finds this rejects the file outright - sometimes without even offering a rectification window.
The second is MTTFD values with no provenance. The report lists beautiful MTTFD numbers, and when asked for the source, nobody can answer. The rule: manufacturer manual, B10d conversion, or the standard's annex tables - cite one per component. A number with no source counts as zero in a review.
The third is the CCF checklist treated as decoration. The 65-point checklist is scored item by item; a short score or unimplemented measures downgrade the architecture a category, and the PL drops with it. Reviewers check separate wiring and overvoltage protection on the shop floor. Those are visible. You cannot fake them.
The fourth is inflated DCavg. A single-channel architecture with a watchdog does not earn high diagnostic coverage. If you cannot justify the number, write it lower. Claiming PLc conservatively and passing first time always beats claiming PLd and getting sent back.
My standing defense against all four is the PL traceability table: one row per safety function, five columns - function name, input-logic-output component chain, PLr, calculated PL, and the page numbers in the SISTEMA report and validation report. Get those five columns to agree and half your rectification risk disappears. It also pays off in maintenance: swap one component and you revise only that row instead of rebuilding the whole file.
Sequence matters too. Freeze the PLr during the risk assessment, run a preliminary SISTEMA pass before selecting hardware, and compute the final version only after components are locked in. Reverse the order - buy everything first, backfill the calculations later - and every component change triggers a full recalculation cycle. That is how schedules quietly die.
Here is something you can use tomorrow: ask your supplier for the MTTFD source of every safety component - the manual page or the B10d value. If they cannot produce it, do not sign the purchase order, no matter how attractive the price. In the PL game, the certificate is not where you win or lose. You win or lose on whether every link in the calculation chain has a source.
