EN IEC 62061, “Safety of machinery – Functional safety of safety-related control systems (IEC 62061:2021)”, defines how the safety functions of a machine are designed and verified using safety integrity levels (SIL). It adapts the approach of IEC 61508 to the machinery sector. It serves the same purpose as EN ISO 13849-1, and the manufacturer may choose either.
Let us take care of EN IEC 62061 testing and the CE marking of your machine together; CE Danışmanı (CE Consultant) manages the whole process.
EN IEC 62061 at a glance
| Edition cited in the EU Official Journal | EN IEC 62061:2021 |
|---|---|
| Official title | Safety of machinery – Functional safety of safety-related control systems (IEC 62061:2021) |
| Legislation supported | Machinery Directive 2006/42/EC; from 20 January 2027 Machinery Regulation (EU) 2023/1230 |
| Type of standard | Type B standard |
| Safety levels | SIL 1, SIL 2 and SIL 3. Target probability of dangerous failure per hour (PFH): 10⁻⁶ to 10⁻⁵ for SIL 1, 10⁻⁷ to 10⁻⁶ for SIL 2, 10⁻⁸ to 10⁻⁷ for SIL 3 |
Which systems are covered?
The standard applies to control systems that perform the safety functions of a machine. The cited edition is not limited to electrical systems; it can also be used for safety functions that include other technologies such as hydraulics and pneumatics. Typical applications:
- Complex safety functions built with a safety PLC
- Safe speed, safe position and safe stop functions on multi-axis machines
- Safety circuits for light curtains, scanners and door switches
- Lines of linked machines and robot cells
- Safety components supplied with SIL data by subsystem manufacturers
The standard deals with levels up to SIL 3; SIL 4 is not used for machinery. Complex electronic subsystems are themselves developed to IEC 61508; EN IEC 62061 describes how subsystems are combined into a safety function.
Main requirements of the standard
- Functional safety plan: Responsibilities, competence, verification activities and change management are defined at the start.
- Safety requirements specification: What each safety function does, its response time and the required SIL are written down.
- SIL assignment: The required SIL is set from the severity of harm, the frequency of exposure, the probability of the hazardous event and the possibility of avoidance.
- Subsystems: The safety function is split into input, logic and output subsystems, each with a limit on the SIL it can claim.
- Hardware safety integrity: The probability of dangerous failure is calculated for each subsystem, taking account of architecture, fault tolerance and diagnostic coverage.
- Common cause failure: Measures against redundant channels failing together are scored.
- Systematic integrity and software: Measures to avoid and control design errors are applied; application software is developed and tested under graded rules.
EN IEC 62061 verification and validation
Verification takes place at each design stage and validation on the completed system, both by persons sufficiently independent of the design.
| Test or check | What is verified? |
|---|---|
| Specification review | Safety functions and SIL targets are consistent with the risk assessment |
| PFH calculation | The total probability of dangerous failure of the subsystems stays within the target SIL range |
| Architectural constraints | Fault tolerance and diagnostics of each subsystem are sufficient for the SIL claimed |
| Functional tests | Each safety function works on the machine as specified and meets its response time |
| Fault simulation | With a single fault the system goes to a safe state and the fault is detected |
Failure data come from the component manufacturers. For components without data, the estimation methods allowed by the standard are used and the assumptions are recorded.
Its place in the CE marking process
- Risk assessment: The risk reduction measures that rely on the control system, that is the safety functions, are identified under EN ISO 12100.
- Design: A SIL is set for each function, subsystems are selected and the PFH is calculated.
- Verification: The functions are validated by test and analysis.
- Technical file: The safety requirements specification, calculations, software records and validation report go into the technical file.
- Declaration of conformity: EN IEC 62061 is listed among the standards applied.
Conformity with a harmonised standard gives presumption of conformity with the relevant essential requirements of the machinery legislation. Turkey applies the same rules through its own regulation aligned with 2006/42/EC. See also CE marking of machinery.
Standards applied together
- EN ISO 13849-1: The performance level (PL) approach to the same task
- EN ISO 13849-2: Validation in the PL approach
- EN 60204-1: Electrical equipment of machines
- EN ISO 13850: Emergency stop function
Frequently asked questions
EN IEC 62061 or EN ISO 13849-1?
Both are harmonised for machinery and give the same result. EN ISO 13849-1 is mostly used for simple, category-based circuits and EN IEC 62061 for complex, software-heavy systems. Where a Type C machine standard asks for one of them, that one is followed.
Is a SIL-rated component enough?
No. The SIL of a component only shows the upper limit of that subsystem. The calculation and the validation are still needed for the complete safety function.
Which edition applies?
The edition cited in the EU Official Journal is EN IEC 62061:2021. Check the current citation before testing starts.
Other standards in this group
- EN ISO 14118: Prevention of Unexpected Start-Up
- EN 60204-1: Electrical Equipment of Machines
- EN ISO 4413: Hydraulic Fluid Power Safety
- EN ISO 4414: Pneumatic Fluid Power Safety
