Safety software validation under EN ISO 13849 means proving, with documented evidence, that the safety-related application software in your PLC implements each safety function as specified and achieves the required Performance Level. The standard sets requirements for safety-related application software (SRASW) that scale with the Performance Level, and EN ISO 13849-2 covers validation. In German practice, the IFA's matrix method gives a structured way to plan, specify, test and document that software (IFA Report 2/2016).
The topic is getting more attention because the EU Machinery Regulation, which applies from 20 January 2027, explicitly treats software as a possible safety component and adds requirements on protecting safety software and logging later updates (European Commission). This guide is written for the controls engineers who write the code and the safety engineers who sign it off.
Where software sits in EN ISO 13849
EN ISO 13849-1 treats a safety function as a chain: input (for example a light curtain), logic (the safety PLC and its program) and output (contactors or a drive's safe torque off). The hardware side is assessed with category, MTTFD, diagnostic coverage and common cause failure, typically calculated in SISTEMA. The software side cannot be calculated in the same way. It is controlled through process: specification, design rules, reviews, testing and documentation, with more rigour required at higher Performance Levels.
The IFA's free SISTEMA software, version 3.0.4 as of October 2025, supports the 2023 edition of ISO 13849-1 and calculates the achieved Performance Level for the hardware architecture. It does not validate your code. That is the job of the software process below.
Safety software validation under EN ISO 13849 in six steps
- Specify each safety function. Trigger, reaction, reaction time, reset behaviour, required PL, and the operating modes in which it is active. Take these from the risk assessment, not from the programmer's memory.
- Specify the software. For each safety function, the inputs, logic and outputs in the PLC, including muting, bypass and mode selection logic.
- Design with restricted means. Use certified safety function blocks from the PLC vendor where they exist, limit the language to what is reviewable (usually FBD or LAD for safety logic), and keep safety and standard code clearly separated.
- Review the code. A second engineer checks the code against the specification, line by line, and records the review.
- Test against the specification. Every safety function, every input state that matters, every fault you can provoke, in every relevant mode.
- Document and freeze. Record the safety program signature or checksum, the test results and the version, and file them in the technical documentation.
The IFA matrix method
The matrix method from the German Social Accident Insurance's IFA links each safety function to the inputs, logic and outputs that implement it in a table, the matrix. The same matrix then drives the code structure, the test plan and the documentation, so nothing is specified without being tested, and nothing is coded without being specified. The free SOFTEMA tool, version 1.4.4 from November 2025, automates the tables. For teams that have never documented safety software formally, it is the most practical starting point we know.
| Phase | Output | Who signs |
|---|---|---|
| Safety function specification | List of functions with PL and behaviour | Safety engineer |
| Software specification | Matrix of inputs, logic and outputs per function | Controls lead |
| Code review | Review record against the matrix | Second engineer |
| Validation tests | Test protocol per function and fault case | Tester and safety engineer |
| Release | Program signature, version, archive | Responsible person for CE |
Everything you need to know about the new edition of ISO 13849
Machinery Safety Academy - Pilz UK
This video is hosted on YouTube. Playing it loads content from Google, which may set cookies.
Watch on YouTubeISO 13849 or IEC 62061?
Both standards are harmonised for machinery. The second edition of IEC 62061, published in 2021 and amended in 2024, covers safety-related control systems of any technology, moves from the SIL claim limit concept to a maximum SIL, and has detailed software requirements, including independence for software verification and validation and requirements for a functional safety plan and configuration management. Most machine builders using safety PLCs for typical machine functions stay with EN ISO 13849. IEC 62061 is more common where complex programmable systems or SIL-based customer requirements are involved.
What the Machinery Regulation adds from 2027
The regulation does not replace EN ISO 13849, but it adds expectations that touch safety software directly: identify and protect the software that is critical for compliance, collect evidence of interventions in it, and keep a log of safety software versions uploaded after the machine is placed on the market for five years. Our article on the EU Machinery Regulation 2027 and control software covers these points. Practically, it means your validation package should include the program signature at delivery, and your service process should create a new record each time it changes.
Common weaknesses in safety software
- Safety and standard code mixed in the same blocks, so every standard change touches the safety program.
- Muting and bypass logic added during commissioning without being added to the specification.
- Reset behaviour that differs between operating modes and is tested in only one of them.
- No record of which safety program version is on which machine in the field.
- Validation reports that list functions as "OK" without describing what was tested.
How Wartens supports safety software work
Wartens writes safety PLC programs as part of our machine work packages and prepares the safety software documentation, from the function matrix to the test protocol, for your safety team and CE partner to review. We do not carry out CE marking. See our automation engineering services, and if you are outsourcing a whole machine program, read outsourcing PLC programming in Germany.
Next step: send us the safety function list and current safety program of one machine. We will return a gap list against the matrix method. Contact us.
