SISTEMA Risk Assessment: From Risk Graph to Performance Level

Machine guarding failures drew 1,239 OSHA citations in fiscal 2025, the standard’s 20th-plus consecutive year on the agency’s Top 10 most-cited list, and machinery still costs US workers roughly 18,000 amputations, crush injuries, and lacerations a year. A SISTEMA risk assessment attacks that toll at the design stage.

SISTEMA, the Safety Integrity Software Tool for the Evaluation of Machine Applications, is free software from Germany’s IFA, the research institute of the DGUV accident insurers. Machine builders worldwide use it to verify that safety functions meet EN ISO 13849-1 performance levels.

SISTEMA Risk Assessment: Key Takeaways
SISTEMA is the IFA’s free software for verifying safety functions against EN ISO 13849-1; the risk assessment behind it sets the required performance level, PLr.
Machine guarding drew 1,239 OSHA citations in fiscal 2025 and has sat on the agency’s Top 10 list for more than 20 straight years.
The risk graph sets PLr from three calls: severity (S), frequency of exposure (F), and possibility of avoidance (P). Document the reasoning for each.
SISTEMA then verifies the achieved PL from Category, MTTFd, DCavg, and CCF; a PL below PLr means redesign, not a rounded-up report.
SISTEMA 3.0 (version 3.0.1.1, April 2025) implements the 2023 fourth edition of ISO 13849-1, including the renamed PFH failure measure.
Circle January 20, 2027: the EU Machinery Regulation 2023/1230 replaces the Machinery Directive, and exports to Europe will be assessed against it.

The tool only checks arithmetic; the SISTEMA risk assessment supplies the judgment. This guide walks the full chain: the risk graph that sets a required performance level, the parameters SISTEMA needs to verify the achieved one, a worked guard-door example, and the 2027 regulatory deadline pressing on all of it, in Chicago job shops and Stuttgart OEM plants alike.

What a SISTEMA Risk Assessment Covers and Where It Fits

Machinery safety runs on two linked standards. ISO 12100 governs the overall machine risk assessment, hazard by hazard, while EN ISO 13849-1 takes over wherever a control system performs a safety function: an interlocked guard, a light curtain, a two-hand control. SISTEMA lives in that second territory.

The workflow follows the risk assessment process every discipline shares, tuned for controls. Identify each safety function, set its required performance level with the risk graph, design the safety-related parts, then let SISTEMA verify the design meets the requirement. US builders map the same output to ANSI B11 standards and OSHA expectations.

Layer	Standard that governs it	What it produces
Whole machine	ISO 12100 risk assessment	Hazard list, risk reduction plan
Safety function	EN ISO 13849-1 risk graph	Required performance level, PLr
Control design	EN ISO 13849-1 verification	Achieved PL, proven in SISTEMA
US workplace	OSHA 1910.212 and ANSI B11	Guarding that survives inspection

The US Injury Numbers Behind Every SISTEMA Risk Assessment

The design-stage discipline exists because the downstream numbers refuse to improve. OSHA’s guidance on safeguarding against amputations counts about 18,000 machinery-related amputations, lacerations, and crushing injuries plus more than 800 deaths a year, and BLS injury data keeps power presses near the top of the amputation table.

Machine Guarding Citations That Frame the SISTEMA Risk Assessment

Figure 1. Machine guarding logged 1,239 preliminary FY2025 citations, its third decade running on OSHA’s Top 10.

Enforcement math sharpens the point. A serious 1910.212 violation now carries a maximum penalty of $16,550, a willful or repeat citation $165,514, and the National Safety Council notes the same standards repeat year after year. A guard door engineered to a verified performance level is cheaper than either invoice.

The Risk Graph: How a SISTEMA Risk Assessment Sets PLr

Every safety function starts with three judgment calls at the hazard, made before any component is chosen. Severity asks whether the worst credible injury is slight or irreversible. Frequency asks how often anyone is exposed, and probability asks whether avoidance is realistically possible at working speed.

Reading the Risk Graph in a SISTEMA Risk Assessment

Figure 2. Three S, F, P decisions route each safety function to a required performance level from a to e.

Honest inputs matter more than the routing. Grading severity down because an injury is merely likely rather than certain, or exposure down because operators are trained, produces a PLr the machine’s history will eventually contradict. Structured hazard identification before the graph keeps the S, F, and P calls anchored to the task list.

From PLr to Verified PL in the SISTEMA Risk Assessment

Setting PLr is half the job; proving the design achieves it is the half SISTEMA automates. The tool takes the architecture Category from B through 4, component reliability as MTTFd, diagnostic coverage as DCavg, and common cause failure scoring, then computes the achieved PL and the PFH failure rate.

The Five Performance Levels a SISTEMA Risk Assessment Verifies

Figure 3. Each performance level caps the average frequency of a dangerous failure per hour; PL e is the strictest.

SISTEMA input	What it measures	Where the data comes from
Category (B to 4)	Architecture: redundancy and monitoring	Circuit design and fault behavior
MTTFd	Mean time to dangerous failure per channel	Component manufacturer data or Annex C
DCavg	Share of dangerous failures diagnostics catch	Measure selection per Annex E
CCF score	Resistance to common cause failure	65-point checklist, 2-channel systems

Component libraries carry most of the data burden. Manufacturers publish SISTEMA libraries with tested MTTFd and B10d values, so a verification that once took a spreadsheet week now takes an afternoon, one reason auditors prefer computed reliability over qualitative guessing. Missing library data sends you to the standard’s Annex tables instead.

Running SISTEMA: A Worked Risk Assessment Example

Walk the graph with a real guard door. A packaging machine’s feed rollers can crush a hand, so severity reads S2, irreversible. Operators clear jams a few times per shift behind an interlocked door, but approach is slow and visible, so the calls land F2 for exposure and P1 for avoidance: PLr d.

Risk graph call	Evidence recorded	Result
Severity: S2	Roller nip can amputate fingers	Routes toward higher PLr
Frequency: F2	Jam clearing several times per shift	Frequent exposure branch
Avoidance: P1	Slow approach, full visibility, stop time adequate	Avoidance possible
Required level	S2, F2, P1 on the risk graph	PLr = d

Verification then runs in the tool. Two-channel Category 3 architecture, safety-rated interlock switches with library data, high MTTFd, 90 percent DCavg, and a passing CCF score compute to PL d, matching the requirement. That logic transfers to a conveyor belt assessment or an injection moulding machine, function by function.

Files we audit fail at the documentation layer more than the math layer. SISTEMA prints a tidy report, but auditors and expert witnesses ask why F2 was chosen over F1, and a scenario-based writeup of the operator tasks is the only convincing answer. Record the reasoning while the design meeting is still in the room.

SISTEMA Risk Assessment Versions, Libraries, and Setup

Tooling currency became a real issue in 2023. The fourth edition of ISO 13849-1 restructured subsystems and renamed the failure measure to PFH, and SISTEMA 3.0 implements those changes; the current build is 3.0.1.1 from April 2025. Projects verified in old versions against the 2015 text deserve a re-run.

Setup step	Where	Practical note
Download SISTEMA	IFA / DGUV website, free	Register once; no license cost
Load component libraries	Manufacturer websites	Match library version to component revision
Structure the project	One safety function per entry	Mirror the machine’s function list
Archive with the file	Risk graph evidence, task analysis	The report alone is not the assessment

Treat the SISTEMA project file as a living engineering document. Component substitutions, speed increases, and new operator tasks all shift the inputs, so tie reassessment frequency to engineering change orders, and store the file beside the critical components list it depends on.

Key SISTEMA Risk Assessment Questions from Machine Builders

What is a SISTEMA risk assessment?

A SISTEMA risk assessment is the combined process of setting a required performance level for each machine safety function via the ISO 13849-1 risk graph, then verifying in the free IFA SISTEMA software that the designed control system achieves it. The output is a documented PLr-versus-PL comparison per function.

Is the SISTEMA risk assessment tool really free?

Yes. The IFA, the research institute of the German Social Accident Insurance, distributes SISTEMA at no cost, and component manufacturers publish free data libraries for it. Budget goes to engineering time and component data quality, and to training people to defend the risk graph calls behind each assessment template.

Does a SISTEMA risk assessment satisfy OSHA?

Not by itself, because OSHA enforces machine guarding outcomes rather than European design standards. A verified performance level is strong evidence of a properly engineered safeguard, and it complements the ANSI B11 risk assessment US inspectors recognize. Run both and the file answers either audience.

What is the difference between PLr and PL in a SISTEMA risk assessment?

PLr is the performance level the risk graph requires; PL is the level the designed system actually achieves, computed from Category, MTTFd, DCavg, and CCF. SISTEMA compares the two, and any function where PL falls below PLr needs redesign, better components, or added diagnostics before the machine ships.

How does the 2023 edition of ISO 13849-1 change a SISTEMA risk assessment?

The fourth edition restructured subsystem handling, renamed the failure measure to PFH without the D index, and tightened documentation expectations. SISTEMA 3.0 implements the new text, so upgrade the software and re-open legacy projects. Treat the migration as part of the risk management lifecycle, with owners and dates.

Can a SISTEMA risk assessment replace the machine-level risk assessment?

No: the ISO 12100 machine-level assessment decides which risks need control-system measures at all, and it comes first, following a step-by-step method. SISTEMA handles the safety functions that assessment creates. Skipping the machine-level pass produces beautifully verified functions guarding the wrong hazards.

Recurring SISTEMA Risk Assessment Mistakes and Their Fixes

SISTEMA makes the arithmetic easy, which pushes the failure points upstream into judgment and data. Six mistakes below cover most of the findings in the machine files we review, and every remedy amounts to a better-documented input, never a different tool.

Mistake	Root cause	Remedy
Risk graph calls with no written rationale	PLr set in a meeting, evidence lost	Attach task analysis to every S, F, P decision
Severity graded down for trained operators	Confusing likelihood with severity	Score S on worst credible injury, period
Generic MTTFd values in place of library data	Component data never requested	Pull manufacturer SISTEMA libraries; log versions
CCF checklist scored from memory	65-point list treated as formality	Walk the checklist against the actual panel
Verified once, never re-run after changes	Project file treated as archive	Re-verify on every engineering change order
Old SISTEMA version against the 2023 standard	Tooling never upgraded	Move to 3.0.1.1 and re-open legacy projects

The 2027 Deadline Shaping the SISTEMA Risk Assessment

January 20, 2027 is the date to circle. Regulation (EU) 2023/1230 replaces the Machinery Directive on that day, bringing software updates, AI-enabled safety functions, and cybersecurity into machinery conformity for the first time. Any builder exporting to Europe will present SISTEMA files against the new regulation’s expectations.

Component data keeps improving underneath the tool. Manufacturers now ship libraries updated for the 2023 standard, and the IFA’s machine controls program publishes worked examples that shortcut common architectures. The gap between a rigorous verification and a lazy one is narrowing to the quality of the risk graph reasoning.

US enforcement is not waiting for Brussels. Machine guarding penalties rise with inflation adjustments each January, OSHA’s amputation reduction emphasis keeps manufacturing inspections frequent, and plaintiff engineers read performance level documentation fluently now. Design files that show S, F, P reasoning and verified PLs shorten depositions.

Machines age; their safety files should not. Every feed speed increase, guard modification, and component substitution reopens the arithmetic, and shops that re-verify on change orders will meet 2027 with files already current. That habit costs an afternoon per change and buys a defensible machine for its whole working life.

 

Get Your SISTEMA Risk Assessment Standard-Ready With Risk Publishing

Undocumented risk graph calls turn a proud PL d into courtroom material. Risk Publishing reviews the S, F, P reasoning, component data, and validation plan behind your SISTEMA risk assessment, then documents the file to satisfy an OSHA visit and a notified body alike. Our services page lists the packages, or reach out directly.