# IEC 62061 & ISO 13849: functional safety for machinery — SIL or PL, categories, and which standard to choose

> For machinery safety, two standards coexist: ISO 13849 (Performance Level PL, all technologies) and IEC 62061 (SIL, derived from IEC 61508). Architecture categories, MTTFd, DCavg, CCF, PFHd, PL↔SIL correspondence, convergence of the two standards and the Machinery Regulation 2023/1230. How to choose, mistakes to avoid, good practice.

- Source : https://industryhub.site/en/articles/securite-fonctionnelle-machines-62061-13849
- Published : 2026-06-14
- Author : IndustryHub
- Language : English
- Keywords : iso-13849, iec-62061, performance-level, sil, categorie, mttfd, pfhd, machines

## The context — the machine that restarts at the wrong moment

The scene is sadly ordinary. An operator works on a stopped machine — clearing a jam, cleaning a tool. A guard is open, but restart is not locked out; or the light curtain was muted "just for this setup." The machine restarts. A hand is caught.

Most serious machinery accidents do not come from the absence of protection, but from **failed or defeated safety functions**: a bridged interlock, a muted light curtain, a stop that does not really stop. With the rise of collaborative robotics, the risk moves ever closer to the human. Machinery functional safety exists to guarantee that a function like "door open → safe stop, restart impossible" is not only present but reliable to the required level.

## Two standards for one goal

Where the process world has a single standard ([IEC 61511](/en/standards/iec-61511)), machinery has **two**, inherited from two worlds:

- **ISO 13849** comes from "classic" machinery safety (the former EN 954-1). It covers **all technologies** — mechanical, hydraulic, pneumatic, electrical, electronic — and reasons in **Performance Level (PL)**.
- **IEC 62061** is the machinery application of [IEC 61508](/en/standards/iec-61508). It focuses on **electrical, electronic and programmable** systems and reasons in **SIL**.

Both reach the same goal: designing the safety-related control part of a machine, and both give **presumption of conformity** with the European Machinery Regulation. The common umbrella is **ISO 12100**: the risk assessment that precedes any choice of standard.

## PL and SIL: two scales, one correspondence

ISO 13849 grades the reliability of a function in five **Performance Levels**, from PL a (lowest) to PL e (highest). IEC 62061 uses **SIL** (1 to 3 for machinery). Because machines operate in high-demand or continuous mode, the measured quantity is the **probability of dangerous failure per hour (PFHd)**, not the process PFD.

| PL (ISO 13849) | PFHd (per hour) | Equivalent SIL (IEC 62061) |
|---|---|---|
| a | 10⁻⁵ to 10⁻⁴ | — |
| b | 3·10⁻⁶ to 10⁻⁵ | 1 |
| c | 10⁻⁶ to 3·10⁻⁶ | 1 |
| d | 10⁻⁷ to 10⁻⁶ | 2 |
| e | 10⁻⁸ to 10⁻⁷ | 3 |

The **required** PL (PLr) is determined by a three-parameter risk graph: severity of injury (S), frequency of exposure (F), possibility of avoidance (P). The [risk reduction to SIL](/en/tools/safety/rrf-sil) and [PFD to SIL](/en/tools/safety/pfd-to-sil) calculators help handle these equivalences.

## The ISO 13849 method: category + reliability → PL

The PL a function achieves does not depend only on components. It combines several factors:

- the architecture **category** (see below), which fixes the behaviour under fault;
- the **MTTFd** (mean time to dangerous failure) of each channel, classed low / medium / high;
- the **average diagnostic coverage (DCavg)**: the share of dangerous faults detected;
- the **common-cause failure (CCF)** factor, which must reach a minimum score.

It is the combination that gives the PL — an excellent component in a poor architecture is not enough.

## The architecture categories — the heart of ISO 13849

| Cat. | Principle | Behaviour under fault |
|---|---|---|
| B | Single channel, components meeting basic requirements | A fault can lose the function |
| 1 | Like B, with **well-tried** components and principles | Fewer faults, but a fault is still fatal |
| 2 | Single channel **tested** periodically by the machine | The fault is detected at the next test |
| 3 | **Redundancy**: a single fault does not lose the function | Single-fault tolerance, partial detection |
| 4 | Redundancy **+ high detection** | Accumulation of faults does not lose the function |

Reaching PL e in practice requires a category 3 or 4 architecture. Reaching PL d, at minimum category 3 (or well-diagnosed category 2). It is this category ↔ PL link that structures the design.

## The IEC 62061 method: subsystems and SILCL

IEC 62061 breaks the function into **subsystems** (input, logic, output), each characterised by a **SIL claim limit (SILCL)** and a PFHd. The complete function cannot exceed its weakest subsystem — the chain is worth its weakest link. The logic is that of IEC 61508: architecture, hardware fault tolerance, safe failure fraction, systematic capability.

For complex, programmable functions, IEC 62061 is often more natural; for simple functions covering non-electronic technologies, ISO 13849 is.

## High demand: PFHd, not PFD

This is the key conceptual difference with the process world. A machinery safety function is demanded often — every door opening, every cycle. So you do not measure a "per demand" probability (PFD) but a **probability of dangerous failure per hour (PFHd)**. Periodic testing matters less than in low-demand mode; architecture, diagnostics and intrinsic reliability carry the safety.

## Convergence of the standards and the legal frame

Long competing, the two standards are converging. **IEC 62061:2021** (edition 2) broadened its scope to all technologies, and a joint IEC/ISO effort aims at a future **single standard** reconciling PL and SIL. **ISO 13849-1:2023** is the current edition.

On the legal side, the driver is the **Machinery Regulation (EU) 2023/1230**, which replaces Directive 2006/42/EC and applies from **20 January 2027**. It explicitly introduces **software** safety components and AI, and strengthens cybersecurity — a direct junction with functional safety. Meeting EN ISO 13849-1 or EN IEC 62061 (harmonized standards) gives presumption of conformity.

## The stakes

The first stake is human: amputations, crushing, entanglement — machines injure quickly and lastingly.

The regulatory stake is **CE marking**: without a conformity demonstration (ISO 12100 risk assessment + safety functions at the right PL/SIL), the machine cannot be placed on the EU market.

The **productivity** stake is real too: an over-restrictive function pushes operators to bypass — the ergonomics of safety is a condition of its effectiveness.

## The mistakes not to make

| Mistake | Why people make it | Why it is dangerous |
|---|---|---|
| Choosing a good component without looking at the architecture | "This relay is PL e" | PL depends on category, MTTFd, DCavg and CCF — not on the component alone |
| Aiming for PL e everywhere "to be safe" | Believing you buy safety | Over-cost and complexity; an oversized but badly designed PL is still a bad PL |
| Allowing easy bypass of a function | Making setup convenient | A defeated function is the leading cause of serious accidents |
| Forgetting restart after stop | Thinking only of stopping | A safe stop without restart lockout does not protect the person inside |
| Neglecting validation (ISO 13849-2) | "It seems to work" | Without documented validation, the claimed PL is not demonstrated |

## Good practice

Start from the ISO 12100 risk assessment, function by function, and derive the PLr (or target SIL).

Choose the standard by machine: ISO 13849 for multi-technology coverage and common cases, IEC 62061 for complex programmable functions — both are acceptable.

Design the architecture (category) first, then verify MTTFd, DCavg and CCF; do not confuse component and function.

Get restart right: door open → safe stop **and** restart impossible without acknowledgement.

Make bypassing hard, logged and temporary; design a safety you do not want to defeat.

Validate to ISO 13849-2 and document the conformity file (CE marking).

## Review checklist

- [ ] ISO 12100 risk assessment documented
- [ ] PLr / target SIL determined per function (S/F/P risk graph)
- [ ] Standard chosen and justified (ISO 13849 or IEC 62061)
- [ ] Architecture category consistent with the target PL
- [ ] MTTFd, DCavg and CCF verified and justified
- [ ] PFHd computed and compliant with the required PL/SIL
- [ ] Restart function locked out after stop
- [ ] Bypasses hard, logged and time-bounded
- [ ] ISO 13849-2 validation carried out and documented
- [ ] Conformity file (CE marking) compiled

## Going further

- The [IEC 62061](/en/standards/iec-62061) and [ISO 13849](/en/standards/iso-13849) pages, and the parent standard [IEC 61508](/en/standards/iec-61508).
- The process variant: [Functional safety for the process industries — IEC 61511](/en/articles/securite-fonctionnelle-iec-61511), and the foundation [Functional safety and IEC 61508](/en/articles/securite-fonctionnelle-iec-61508).
- The [Safety PLC](/en/technologies/safety-plc) hub for safety controllers.
- The [risk reduction to SIL](/en/tools/safety/rrf-sil) and [failure rate to MTBF](/en/tools/safety/fit-to-mtbf) calculators.

**One last thing.** PL or SIL, ISO 13849 or IEC 62061: the standards debate is passionate, but it is secondary. What saves a hand is a function correctly assessed, architected to the right category, validated, and that cannot be defeated with one gesture. The standard is only the grammar; safety is what you write with it.