Funktionale Sicherheitsstandards: IEC 61508, ISO 13849 und IEC 62061

If you build or buy industrial machines, the functional safety standards you actually answer to are a small, specific set: IEC 61508 as the parent, and ISO 13849-1 und IEC 62061 as the two machinery-sector standards derived from it. This overview maps how they fit together, when each one applies, and how the Performance Level (PL) and Safety Integrity Level (SIL) scales relate, without the automotive ISO 26262 detour that dominates most “functional safety” search results.

What Functional Safety Actually Means (and What It Doesn’t)

Functional safety is the risk reduction that depends on a system or device working correctly in response to its inputs. A guard bolted over a pinch point is inherent safety, but a light curtain that detects an arm and commands a stop is functional safety: its protection only exists while the control system is actively doing its job.

The UK Health and Safety Executive frames it as managing safety-related systems throughout their lifecycle: assess the hazard and risk, allocate the required risk reduction, specify the safety function and its integrity, then design to satisfy that specification (HSE guidance on functional safety). The key word is functional.

What is functional safety in simple terms?

Functional safety is the branch of machine safety that relies on a safety control loop, sensor, logic, and final switching element, performing a defined safety function on demand. A guarded fence work whether or not anything is powered; a safety function doesn’t. That is why these standards spend most of their pages on failure behaviour: how often the loop may fail dangerously, and how faults are detected before they defeat the whole function.

It’s a common misconception that “CE-marked safe” or a high ingress rating means a machine is functionally safe. Those address different hazards entirely. Functional safety is about whether the stop happens when it has to.

IEC 61508: The Parent Functional Safety Standard

IEC 61508 is the generic, sector-independent standard for the functional safety of electrical, electronic and programmable electronic (E/E/PE) safety-related systems (IEC functional safety overview). It does two things that matter for everyone downstream: it defines the safety lifecycle — a structured path from hazard analysis through to decommissioning that covers both the hardware and software of a safety system to ensure the safety of people around the machine, and it defines the Safety Integrity Level (SIL 1 to 4) as a measure of how much a safety function reduces risk. Almost every sector functional safety standard, machinery included, is an adaptation of IEC 61508 for its own world.

The integrity scale is anchored in a probability of dangerous failure. For high-demand or continuous-mode functions, which is how machine safety functions behave, SIL is expressed as a probability of dangerous failure per hour (PFH_D):

That last row is a frequent point of confusion: SIL 4 exists in IEC 61508 for catastrophic process and nuclear risks, but it is not used for machine guarding. The realistic ceiling for a machinery safety function is SIL 3, or its ISO 13849 equivalent, PL e. So if a vendor offers you a “SIL 4” guarding component, treat the label with suspicion.

The IEC 61508 Standard Family Tree: Which Standard Applies to Your Sector

“Functional safety standards” is a crowded phrase because IEC 61508 spawned a daughter standard for almost every industry. Searching the bare term surfaces mostly automotive content (ISO 26262), which is why so many machine builders end up reading the wrong guide. The map below routes each sector to its standard and integrity metric. For machinery, only two rows matter, ISO 13849-1 and IEC 62061, but knowing where the others sit stops you from importing automotive or process assumptions that do not apply.

*IEC 62304 is a medical device software lifecycle standard aligned with IEC 61508 principles but governed through ISO 14971 risk management and FDA recognition, related to the family rather than a direct machinery-style adaptation.

ISO 13849-1: Performance Levels (PL) for Machinery

ISO 13849-1 is the machinery functional safety standard that covers safety-related parts of control systems (SRP/CS) irrespective of the technology and energy used — electrical, hydraulic, pneumatic or mechanical. Its output is a Leistungsniveau, PL a through PL e, where PL e is the most capable. Crucially, PL is semi-quantitative: you combine a structural Category (B, 1, 2, 3, 4) with quantified inputs, mean time to dangerous failure (MTTF_D), diagnostic coverage (DC) and protection against common-cause failure (CCF) — and read the resulting PL from a look-up table in ISO 13849-1:2023 Annex K.

What is a Performance Level in ISO 13849?

A Performance Level is a graded measure of the probability that a machinery safety function fails dangerously, expressed per hour and arrived at through a Category-plus-reliability look-up. Each level maps to a band of dangerous-failure probability, from PL a (least demanding) to PL e (most demanding). The risk assessment sets a required Performance Level, PL_r, for each safety function.

The designer then has to demonstrate the implemented system reach at least that PL. The required architecture rise with it, a PL e function almost always needs a Category 3 or 4 structure, meaning redundant channels with cross-monitoring so a single fault can’t defeat the stop.

This article keeps PL at the landscape level. The full Category-by-Category method, MTTF_D bands, DC classes and the SISTEMA workflow used to calculate a PL, is the subject of a dedicated ISO 13849 Performance Level (PL a, e) deep-dive in our standards series; this overview stays at the selection level.

IEC 62061: Safety Integrity Levels (SIL) for Machinery Control

IEC 62061 is the other machinery functional safety standard. It is the machinery-sector adaptation of IEC 61508, and it grades a safety function as a SIL (1 to 3 for machinery). Historically the clean division was “ISO 13849 for any technology, IEC 62061 for electrical and programmable control only.” That division is now out of date: the 2021 edition of IEC 62061 widened its scope to include non-electrical technologies and folded in functional safety management, and a joint ISO/IEC working group integrated the ISO 13849 Performance Levels into it. Many published overviews still repeat the old electrical-only framing, do not let it steer your standard choice.

Where SIL differs from PL is method: SIL is fully quantitative. Every component carries a failure rate, and the SIL is calculated directly from the resulting PFH_D rather than read from a Category look-up. The 2021 edition also introduced a more granular SIL matrix-assignment method than ISO 13849’s table, which is one practical reason a designer might prefer 62061 for a complex, software-heavy electrical and electronic control architecture where software safety dominates the failure analysis.

The devices that physically realise these functions are familiar: position switches, two-hand controls, pressure-sensitive mats, Sicherheitslichtvorhänge and laser scanners on the sensing side; safety relays and safety PLCs on the logic side. Whether you certify the loop under ISO 13849 or IEC 62061, the same hardware classes appear, which is exactly why the choice of standard is a methodology decision, not a hardware one.

ISO 13849 vs IEC 62061: How to Choose (and the Merger That Never Happened)

Two machinery standards covering the same job is genuinely confusing, and machine builders feel it. As one machine-safety community puts it, many users are confused by conflicting guidance from suppliers who happen to prefer one standard over the other. So the first thing to settle is the question everyone asks: didn’t these two merge? They were supposed to. A unified standard, IEC/ISO 17305, was scheduled to replace both around 2017, but it was cancelled at the October 2015 plenary of ISO/TC 199, because the committee could not reconcile the differences between the ISO and IEC approaches in time (ISA, InTech 2016). The merger is not dead so much as parked, the completed work now guides both standards onto a converging path through joint working group JWG 14.

Can you use ISO 13849 and IEC 62061 together?

Yes, and in practice many projects do, because both are harmonized to the EU Machinery Directive and ISO/TR 23849 was written specifically to guide their joint application, concluding there is a high degree of correspondence between them. A common pattern is to design the overall architecture and most subsystems under ISO 13849-1, then apply IEC 62061’s quantitative method to a complex programmable subsystem.

What you must not do is mix metrics inside a single claim without translating them, which is where the conversion question below becomes critical.

SIL vs PL: The Conversion Table Everyone Gets Wrong

SIL and PL describe the same idea, how reliably a safety function perform, on two different scales, and treating them as identical is the single most common machinery functional safety error. Because both are anchored in the same per-hour dangerous-failure probability for machinery, there’s a defined correspondence, set out in the guidance report ISO/TR 23849. But it’s conditional, not a dictionary translation. The crosswalk below is the practical reference; read the caveats under it before you quote a single cell.

From Standard to Compliance: The Machinery Functional Safety Lifecycle

Picking a standard is the start, not the finish. Both ISO 13849 and IEC 62061 walk the same lifecycle, a safety-driven development process, and it is the lifecycle, not the certificate, that an auditor or accident investigator examines. The six steps below are the spine of a machinery functional safety file.

A worked example makes it concrete. An emergency-stop loop, which ISO 13850 treats as a complementary protective measure, not a primary safeguard, might be assessed at PL_r d. You meet it with a Category 3 architecture: two channels from the E-stop button through a force-guided safety relay to the contactors, with the relay cross-monitoring both channels so a single stuck contact is detected at the next demand. Each subsystem’s reliability figures are entered into the verification, and the validation step physically proves the stop happens. This is also why USPTO filings for machine safety hardware, for example a “modular safety relay circuit designed to satisfy EN ISO 13849” — describe diagnostics and dual-channel monitoring rather than just switching: the standard is baked into the hardware design.

“In the field we see the standard treated as a paperwork exercise long after the hardware is chosen. It is the other way round. The required Performance Level decides the architecture, the architecture decides which sensor and relay you can use, and only then does the wiring follow. Get that order wrong and the certificate on the box will not save you in validation.”

For machine builders selecting components against a target PL or SIL, our industrial safety solutions overview and the safety light curtain selection guide map specific subsystems to the architecture they support.

What’s Changing: The 2023–2027 Machinery Safety-Standard Change Log

The machinery functional safety landscape is in the middle of its biggest update in a decade, and two of the dates are hard deadlines. If you’re referencing a 2015-vintage standard or directive in a 2026 design file, you’re already behind. Here’s the change log that matters, cross-checked against the current ISO 13849-1:2023 listing.

Two points are worth flagging because secondary summaries get them wrong. First, ISO 13849-2:2012, the validation standard, is still current and has a draft revision underway; the 2023 Part 1 expanded its validation guidance but did not retire Part 2. Second, “machinery functional safety now includes cybersecurity” is a half-truth: the standards reference security and hand the detail to IEC TR 63074, while the EU regulation makes cyber-risk assessment a legal expectation from 2027. The practical action for anyone planning a 2026–2027 machine: re-check that your harmonized-standard references and your conformity route are built on the current editions, and add a cyber-risk line to your safety file now rather than retrofitting it later. Independent market researchers expect functional safety spending to keep climbing, on the order of a 7–8% annual growth rate through the early 2030s, precisely because regulation and connectivity are pulling these requirements into more machines.

Häufig gestellte Fragen