IEC 62061

What is IEC 62061?

IEC 62061 is the international standard for the functional safety of safety-related control systems of machinery, in which each safety function is specified, designed and validated against a SIL (Safety Integrity Level) from 1 to 3. Its official title is Safety of machinery – Functional safety of safety-related control systems. The standard is the machinery-sector implementation of the basic standard IEC 61508 and is used alongside NEN-EN-ISO 13849 to demonstrate that a machine meets the Machinery Directive. Typical applications include a Safety PLC handling an emergency stop, guard interlocking, light curtains and safe speed monitoring.

IEC 62061 and ISO 13849-1 each follow their own method, but according to the standard itself they aim to achieve the same risk reduction.

🧠 What does IEC 62061 cover?

IEC 62061 covers the path from assigning the required safety integrity through to validating the control system. The standard calls such a system an SCS (safety-related control system). Its clauses follow the design process:

1. Specification of the safety function - a safety requirements specification (SRS) records for each function what it does, how fast it must respond, in which operating modes it applies and which SIL is required.
2. Design of the SCS - the function is broken down into sub-functions (detect, evaluate, switch off) that are allocated to subsystems such as a sensor, a logic unit and an actuator or contactor.
3. Design of subsystems - architecture, redundancy, diagnostics, failure rates and measures against common cause failures.
4. Software - requirements for application software at two levels.
5. Validation and documentation - analysis and testing, including fault simulation, plus information for safe use.

The standard applies to machines that are not hand-held while working, and also to groups of machines working together in a coordinated manner. Out of scope are electrical hazards from the control equipment itself (covered by IEC 60204-1), mechanical safeguarding and specific cybersecurity measures. The design of complex programmable electronics, such as a microcontroller board, falls under IEC 61508.

📜 Which editions of IEC 62061 exist?

In Europe, EN IEC 62061:2021 was harmonised under the Machinery Directive by Implementing Decision (EU) 2022/621. The presumption of conformity of the old EN 62061:2005 ended on 11 October 2023. From 20 January 2027 the Machinery Regulation (EU) 2023/1230 applies, and harmonised standards then need to be cited again under that regulation.

🔢 How do you determine the required SIL?

IEC 62061 builds on a risk assessment according to ISO 12100. Informative Annex A provides a matrix method in which you score four parameters for each hazard:

• Severity (Se) - 1 (reversible, first aid) to 4 (irreversible: death, loss of an eye or arm)
• Frequency and duration of exposure (Fr) - 1 to 5, depending on how often someone is exposed and whether each exposure lasts longer or shorter than ten minutes; exposure at least once an hour always scores 5
• Probability of the hazardous event (Pr) - 1 (negligible) to 5 (very high)
• Possibility of avoiding or limiting harm (Av) - 1 (probable), 3 (rarely) or 5 (impossible)

The class Cl = Fr + Pr + Av ranges from 3 to 15. Severity and class together give the required SIL. In the current version the matrix also states the corresponding required Performance Level (PLr) next to the SIL.

OM means other measures are recommended. An example: an operator who briefly enters a robot cell several times a day, each time for less than ten minutes (Fr 4), a hazardous movement that is very likely to occur (Pr 5), no room to step aside (Av 5) and possible loss of fingers (Se 3). That gives Cl 14 and therefore SIL 3, which corresponds to PL e.

🔧 How do you design a safety function to IEC 62061?

The required SIL translates into a maximum PFHd, the average frequency of dangerous failure per hour. IEC 62061 assumes high-demand or continuous mode; a function that is demanded at least once a year may be treated as high demand.

SIL 4 does not exist in IEC 62061; that level is only found in IEC 61508 and IEC 61511. The PFHd of the complete SCS is the sum of its subsystems. For each subsystem you choose one of four basic architectures:

• A - single channel without diagnostics (hardware fault tolerance HFT 0)
• B - dual channel without diagnostics (HFT 1)
• C - single channel with diagnostics (HFT 0); the diagnostic test must run at least a hundred times more often than the function is demanded
• D - dual channel with diagnostics (HFT 1), the usual structure for SIL 3

Beyond the calculation, architectural constraints apply. The safe failure fraction (SFF) and the HFT determine the maximum SIL a subsystem may claim. A single-channel element with an SFF between 90 and 99 per cent reaches at most SIL 2; SIL 3 with HFT 0 needs an SFF of at least 99 per cent. The common cause factor β (1 to 10 per cent) is also taken into account, and the lifetime used in the calculation is capped at twenty years.

Subsystems designed to ISO 13849-1, or certified components with a stated SIL or PL, can be included in an IEC 62061 function as pre-designed subsystems. This lets you combine a safety relay rated PL e, a variable frequency drive with a safe torque-off input and a safety PLC in a single calculation.

💻 What does IEC 62061 require for software?

Edition 2 distinguishes two levels of application software:

• SW level 1 - programming in a limited variability language such as ladder diagram, FBD or SFC from IEC 61131, usually with pre-certified function blocks on a safety PLC. A simplified V-model is sufficient.
• SW level 2 - programming in a full variability language such as C, C++ or Instruction List. This calls for an extended V-model, modular design, static and dynamic analysis, and integration testing.

Both levels come with requirements for coding guidelines, verification, documentation and modification management. Edition 2 also sets minimum levels of independence for reviews, verification and validation. Software used to set safety parameters, such as speed limits in a drive, is covered by the requirements as well.

🔐 How does IEC 62061 relate to cybersecurity?

IEC 62061 deals with functional safety, not information security. Subclause 6.8 does require you to consider whether security threats could compromise a safety function, and refers to IEC TS 63074 for the measures. That specification builds on IEC 62443. This is becoming more important because the Machinery Regulation requires protection against corruption of safety-relevant software.

In practice this means:

• Password protection and access control on the safety program and its parameterisation
• Safety communication via a safety protocol such as PROFIsafe or CIP Safety, which detects errors in the transport itself
• Configuration management with checksums, so that every change to the safety program can be demonstrated
• Change management through MOC, with every change verified and validated again

🏭 Where is IEC 62061 used in industry?

IEC 62061 is especially common on complex machines with programmable safety technology: robot cells, packaging lines, presses, intralogistics and production lines with several safety zones. Sectors include automotive, food and beverage, pharmaceuticals, metalworking and logistics across industrial automation.

After handover, the operator remains responsible. Edition 2 requires the manufacturer to specify periodic tests of the safety functions. In the Netherlands, the employer includes those tests in the RI&E (the statutory risk inventory and evaluation) and the maintenance plan. Work on the installation is carried out under Lock-out Tag-out and a work permit. An internal or external audit checks whether tests, changes and documentation are in order.

❓ Frequently asked questions

What is the difference between IEC 62061 and ISO 13849-1?

IEC 62061 expresses the reliability of a safety function as SIL 1 to 3, using basic architectures A to D and full software requirements. ISO 13849-1 uses Performance Levels a to e, based on categories, MTTFd, diagnostic coverage and CCF. Both standards calculate with PFHd and both are harmonised, so you can choose either and use subsystems from one standard in the other.

Which SIL levels does IEC 62061 use?

IEC 62061 uses SIL 1, SIL 2 and SIL 3, with a permitted PFHd of less than 10⁻⁵, 10⁻⁶ and 10⁻⁷ dangerous failures per hour respectively. SIL 4 is outside the scope of IEC 62061. That level only appears in IEC 61508 and in the process industry under IEC 61511.

Is IEC 62061 mandatory?

IEC 62061 is not a legal obligation. A machine built in accordance with the harmonised EN IEC 62061:2021 does, however, benefit from a presumption of conformity with the control-system safety requirements of the Machinery Directive. A manufacturer may also use ISO 13849-1 or another demonstrably equivalent approach.

What is the current version of IEC 62061?

The current version of IEC 62061 is edition 2 from March 2021, supplemented by amendment 1 from 2024 and amendment 2 from 2026. The consolidated version is called edition 2.2. In Europe, EN IEC 62061:2021 is harmonised, and the old EN 62061:2005 has no longer provided a presumption of conformity since 11 October 2023.

What does maximum SIL mean in IEC 62061?

Maximum SIL is the highest SIL that a subsystem may claim under IEC 62061 on the basis of the architectural constraints, meaning its hardware fault tolerance and safe failure fraction. Edition 2 introduced the term to replace the older SILCL. The SIL of a complete safety function can never be higher than the lowest maximum SIL of the subsystems it uses.

Does IEC 62061 also apply to pneumatics and hydraulics?

Since edition 2 in 2021, IEC 62061 has been extended to non-electrical technologies such as pneumatic and hydraulic subsystems. Annex C provides typical MTTFd values for them. Previously, IEC 62061 was limited to electrical, electronic and programmable electronic systems.

📌 In summary

IEC 62061 is the machinery standard for functional safety that lets you specify, design and validate a safety function based on SIL 1 to 3. With the Annex A matrix method, PFHd limits per SIL, basic architectures A to D, two software levels and a pointer to security for cyber threats, edition 2 (2021, amended in 2024 and 2026) offers a fully substantiated alternative to ISO 13849-1 that is aligned with IEC 61508.