IEC 62061 & ISO 13849: functional safety for machinery — SIL or PL, categories, and which standard to choose

The context — the machine that restarts at the wrong moment

The scene is sadly ordinary. An operator works on a stopped machine — clearing a jam, cleaning a tool. A guard is open, but restart is not locked out; or the light curtain was muted “just for this setup.” The machine restarts. A hand is caught.

Most serious machinery accidents do not come from the absence of protection, but from failed or defeated safety functions: a bridged interlock, a muted light curtain, a stop that does not really stop. With the rise of collaborative robotics, the risk moves ever closer to the human. Machinery functional safety exists to guarantee that a function like “door open → safe stop, restart impossible” is not only present but reliable to the required level.

Two standards for one goal

Where the process world has a single standard (IEC 61511), machinery has two, inherited from two worlds:

ISO 13849 comes from “classic” machinery safety (the former EN 954-1). It covers all technologies — mechanical, hydraulic, pneumatic, electrical, electronic — and reasons in Performance Level (PL).
IEC 62061 is the machinery application of IEC 61508. It focuses on electrical, electronic and programmable systems and reasons in SIL.

Both reach the same goal: designing the safety-related control part of a machine, and both give presumption of conformity with the European Machinery Regulation. The common umbrella is ISO 12100: the risk assessment that precedes any choice of standard.

PL and SIL: two scales, one correspondence

ISO 13849 grades the reliability of a function in five Performance Levels, from PL a (lowest) to PL e (highest). IEC 62061 uses SIL (1 to 3 for machinery). Because machines operate in high-demand or continuous mode, the measured quantity is the probability of dangerous failure per hour (PFHd), not the process PFD.

PL (ISO 13849)	PFHd (per hour)	Equivalent SIL (IEC 62061)
a	10⁻⁵ to 10⁻⁴	—
b	3·10⁻⁶ to 10⁻⁵	1
c	10⁻⁶ to 3·10⁻⁶	1
d	10⁻⁷ to 10⁻⁶	2
e	10⁻⁸ to 10⁻⁷	3

The required PL (PLr) is determined by a three-parameter risk graph: severity of injury (S), frequency of exposure (F), possibility of avoidance (P). The risk reduction to SIL and PFD to SIL calculators help handle these equivalences.

The ISO 13849 method: category + reliability → PL

The PL a function achieves does not depend only on components. It combines several factors:

the architecture category (see below), which fixes the behaviour under fault;
the MTTFd (mean time to dangerous failure) of each channel, classed low / medium / high;
the average diagnostic coverage (DCavg): the share of dangerous faults detected;
the common-cause failure (CCF) factor, which must reach a minimum score.

It is the combination that gives the PL — an excellent component in a poor architecture is not enough.

The architecture categories — the heart of ISO 13849

Cat.	Principle	Behaviour under fault
B	Single channel, components meeting basic requirements	A fault can lose the function
1	Like B, with well-tried components and principles	Fewer faults, but a fault is still fatal
2	Single channel tested periodically by the machine	The fault is detected at the next test
3	Redundancy: a single fault does not lose the function	Single-fault tolerance, partial detection
4	Redundancy + high detection	Accumulation of faults does not lose the function

Reaching PL e in practice requires a category 3 or 4 architecture. Reaching PL d, at minimum category 3 (or well-diagnosed category 2). It is this category ↔ PL link that structures the design.

The IEC 62061 method: subsystems and SILCL

IEC 62061 breaks the function into subsystems (input, logic, output), each characterised by a SIL claim limit (SILCL) and a PFHd. The complete function cannot exceed its weakest subsystem — the chain is worth its weakest link. The logic is that of IEC 61508: architecture, hardware fault tolerance, safe failure fraction, systematic capability.

For complex, programmable functions, IEC 62061 is often more natural; for simple functions covering non-electronic technologies, ISO 13849 is.

High demand: PFHd, not PFD

This is the key conceptual difference with the process world. A machinery safety function is demanded often — every door opening, every cycle. So you do not measure a “per demand” probability (PFD) but a probability of dangerous failure per hour (PFHd). Periodic testing matters less than in low-demand mode; architecture, diagnostics and intrinsic reliability carry the safety.

Convergence of the standards and the legal frame

Long competing, the two standards are converging. IEC 62061:2021 (edition 2) broadened its scope to all technologies, and a joint IEC/ISO effort aims at a future single standard reconciling PL and SIL. ISO 13849-1:2023 is the current edition.

On the legal side, the driver is the Machinery Regulation (EU) 2023/1230, which replaces Directive 2006/42/EC and applies from 20 January 2027. It explicitly introduces software safety components and AI, and strengthens cybersecurity — a direct junction with functional safety. Meeting EN ISO 13849-1 or EN IEC 62061 (harmonized standards) gives presumption of conformity.

The stakes

The first stake is human: amputations, crushing, entanglement — machines injure quickly and lastingly.

The regulatory stake is CE marking: without a conformity demonstration (ISO 12100 risk assessment + safety functions at the right PL/SIL), the machine cannot be placed on the EU market.

The productivity stake is real too: an over-restrictive function pushes operators to bypass — the ergonomics of safety is a condition of its effectiveness.

The mistakes not to make

Mistake	Why people make it	Why it is dangerous
Choosing a good component without looking at the architecture	”This relay is PL e”	PL depends on category, MTTFd, DCavg and CCF — not on the component alone
Aiming for PL e everywhere “to be safe”	Believing you buy safety	Over-cost and complexity; an oversized but badly designed PL is still a bad PL
Allowing easy bypass of a function	Making setup convenient	A defeated function is the leading cause of serious accidents
Forgetting restart after stop	Thinking only of stopping	A safe stop without restart lockout does not protect the person inside
Neglecting validation (ISO 13849-2)	“It seems to work”	Without documented validation, the claimed PL is not demonstrated

Good practice

Start from the ISO 12100 risk assessment, function by function, and derive the PLr (or target SIL).

Choose the standard by machine: ISO 13849 for multi-technology coverage and common cases, IEC 62061 for complex programmable functions — both are acceptable.

Design the architecture (category) first, then verify MTTFd, DCavg and CCF; do not confuse component and function.

Get restart right: door open → safe stop and restart impossible without acknowledgement.

Make bypassing hard, logged and temporary; design a safety you do not want to defeat.

Validate to ISO 13849-2 and document the conformity file (CE marking).

Review checklist

Going further

The IEC 62061 and ISO 13849 pages, and the parent standard IEC 61508.
The process variant: Functional safety for the process industries — IEC 61511, and the foundation Functional safety and IEC 61508.
The Safety PLC hub for safety controllers.
The risk reduction to SIL and failure rate to MTBF calculators.

One last thing. PL or SIL, ISO 13849 or IEC 62061: the standards debate is passionate, but it is secondary. What saves a hand is a function correctly assessed, architected to the right category, validated, and that cannot be defeated with one gesture. The standard is only the grammar; safety is what you write with it.