When to choose IEC 62061 vs ISO 13849

Both are harmonized under the EU Machinery Directive 2006/42/EC. Both cover the safety control system of a machine. Applied correctly, they deliver the same level of risk reduction. The choice is mostly about vocabulary and tooling:

Aspect	ISO 13849-1	IEC 62061
Vocabulary	PL a-e, Categories B/1/2/3/4	SIL 1-3, Architectures A-D
Origin	Mechanical engineering tradition (ex-EN 954-1)	IEC 61508 machinery adaptation
Mode	High demand only (PFHD)	High demand only (PFHD)
Software	Simplified treatment	Full IEC 61508-3 software requirements
Component certification	Wide (Pilz, Sick, Schmersal libraries)	Wide (overlaps with IEC 61508)
Designer tool	SISTEMA (free, IFA)	Spreadsheet calculators, SISTEMA support
Best fit	Standard machinery (assembly lines, conveyors, presses)	Complex machinery with significant programmable-electronic content

In practice: ISO 13849 dominates Europe for typical machinery. IEC 62061 is preferred when:

1. The machine has substantial embedded software logic (complex programmable safety controllers — the IEC 62061 software requirements, taken from IEC 61508-3, are more rigorous).
2. The vendor wants to leverage existing IEC 61508 component certifications without rework.
3. The machine sits at the boundary between machinery and process industry (e.g. a packaging machine in a chemical plant) where SIL language matches the rest of the plant’s safety functions.

How the required SIL is determined

62061 does not invent its own risk-assessment universe — the target SIL is derived from the machine risk assessment per ISO 12100. Edition 1 (2005) shipped an informative scoring method that many engineers still recognise:

Required SIL = f( Severity Se , Class Cl )
   Cl = Fr (frequency/duration of exposure)
      + Pr (probability of the hazardous event)
      + Av (probability of avoiding/limiting harm)

Severity Se (1-4) is read against the class Cl (3-15) in a lookup table to give SIL 1, 2, 3 — or “OM / other measures” for low risk. Edition 2 (2021) defers the estimation itself to ISO 12100 and keeps the result harmonized with the ISO 13849 PLr route, so a design team can move between PLr a-e and SIL 1-3 without re-running the hazard analysis.

The 4 architectures

IEC 62061 simplifies architectures into 4 classes, each with a closed-form PFHD formula:

Arch	Description	Equivalent ISO 13849
A	Single channel, no diagnostics	Cat B / 1
B	Single channel with diagnostics (test before use)	Cat 2
C	Redundant channels (1oo2), no diagnostics	Cat 3 (partial)
D	Redundant channels with cross-monitoring + diagnostics	Cat 3 / Cat 4

For SIL 3 (the typical maximum in machinery), architecture D is required: dual channel with cross-monitoring achieving DC > 99 %.

Decomposing the SRECS into subsystems

A 62061 calculation is a subsystem exercise, not a single number:

1. Split the safety function into sensor → logic → final element subsystems.
2. For each subsystem, establish its SILCL (from HFT + SFF) and its PFHD (from the architecture formula, component failure rates, DC, β and the proof-test/mission time).
3. The system PFHD is the sum of subsystem PFHD values — it must stay inside the target SIL band.
4. The system SILCL is the minimum SILCL across the subsystems — a SIL 3 logic solver behind a SILCL 2 sensor can only ever claim SIL 2.

This is why a single weak link (a non-redundant position switch, an under-diagnosed output stage) caps the whole function regardless of how good the PLC is. The FIT ↔ MTBF and PFD ↔ SIL calculators in our tools section help sanity-check each subsystem before the full architectural roll-up.

Architectural constraints: HFT + SFF + DC

Like IEC 61508-2, 62061 caps the claimable SILCL by hardware fault tolerance and safe failure fraction — the PFHD number alone is never sufficient:

SFF	HFT = 0 (1oo1)	HFT = 1 (1oo2 / 2oo3)
< 60 %	not allowed	SILCL 1
60-90 %	SILCL 1	SILCL 2
90-99 %	SILCL 2	SILCL 3
≥ 99 %	SILCL 3	SILCL 3

A subsystem must satisfy both the PFHD target and this constraint table. High SFF comes from diagnostics, so DC and SFF are tightly linked.

Systematic safety and software

Beyond random hardware failure (the PFHD number), 62061 demands control of systematic failures — design errors, specification gaps, software bugs:

• Software follows an IEC 61508-3-derived V-model, with technique selection scaling by SIL (defensive programming, modular structure, static analysis, structured testing).
• Configuration of pre-certified safety controllers (Pilz PNOZmulti, Siemens S7-1500F, Sick Flexi Soft) is treated as application programming, lighter than full embedded development but still inside the safety plan.
• Change management, verification and validation, and documented competence are mandatory — the same functional-safety-management discipline as IEC 61511, scaled to machinery.

Edition 2 (2021) — what changed

The 2021 revision was substantial, not cosmetic:

• Restructured to align with ISO 13849-1 and IEC 61508 Edition 2 — shared terminology and a parallel design flow reduce friction between the two machinery routes.
• Risk estimation deferred to ISO 12100 rather than mandating an internal method.
• Clarified subsystem design, SILCL and the CCF checklist, and modernised the software clauses.
• Confirmed scope as the electrical, electronic and programmable electronic safety control of machinery — non-electrical technologies (hydraulic, pneumatic, mechanical) remain with ISO 13849.

Joint convergence work (on hold)

ISO and IEC started a joint project — IEC/ISO 17305 — to merge ISO 13849 and IEC 62061 into a single standard. It was suspended around 2015 over unresolved methodological differences. As of 2026 both standards remain active and both will continue to be harmonized under the Machinery Regulation (EU) 2023/1230, which replaces the 2006 Directive from January 2027.

For practitioners: pick one, document the choice in your Safety Requirements Specification, and stick with it for the whole machine. Mixing approaches on the same SRECS creates documentation nightmares.