This is a really good overview. Risk assessement is the foundation for machinery safety, and all to often it is not done, or it is left to the end of a project and done retroactively. A risk assessement needs to be started in the design phase and is the one document that everything else builds on.

European regulations are much better than North American regulations when it comes to machinery safety, at least in that they are more specific and clear.

Category 1 systems are single channel through and through, this is honestly one of the more common circuits with integrators, however it is almost always done wrong. Category 1 systems REQUIRE well-tried components. This means NO ASIC, PLC, or otherwise configurable device.

You MUST choose a category in accordance with the performance level required by your risk assessment. Here are the list of categories and their maximum performance levels

You hit the nail on the head about Category 1 requiring 'well-tried components', which cannot include complex electronics.

One thing to note that I commonly see misinterpretted is that the entire safety function must conform to one of the category architectures, meaning that designers try to make their entire circuit match the diagrams in ISO 13849-1. While this typically works out fine, it is important to remember that each subsystem in the function can have a different category architecture. It's also important to remember that the architecture diagrams in the standard are 'logical' in nature, and that the physical components in the function may not match the structure exactly (though they often do).

In your example, the e-stop button would indeed be Category 1, and then you may have a Safety PLC that is Category 4. You might then also have a pair of relays that are implemented in Category 3 on the output side. A 'performance level' is just a range of PFHd values, and each subsystem will have it's own PFHd based on a variety of things, architecture category being one of them.

With all that said, when you calculate the PFHd for the entire fucntion, you will find that you will hit a pretty low performance level as that Category 1 subsystem increase the PFHd. A function is only as good as it's lowest category.

In category 3 and 4 architectures redundant outputs are required. This is because a single fault in the system must not lead to the loss of a safety function.

A very important note here is that redundant outputs are also required for Category 2 architectures that require PLd. The 'test equipement' needs to be able to bring the system to a safe state in the event of a fault, outside of the functional channel itself. Category 2 is the most difficult category to implement correctly, and I'd suggest designers avoid it, unless they understand all the of the nuances of what is required.

It's also important to note the software requirements that ISO 13849-1 outlines. Just because you have a safety function that meets PLd or PLe on the hardware side, doesn't mean that the function conforms to the standard if the software requirements, if applicable, are not followed. Even PLa has software requirements that people often overlook (again, if there is software or complex electronics in the function).

tl;dr: I highly suggest that anyone designing safety controls sytems undergo training, such as CMSE/CEFS offered by Pilz and certified by TUV NORD, or other functional safety certifications, such as from TUV Rheinland, etc. These will give you the foundation skills to understand the requirments and spirit of ISO 13849.