Functional safety
ISO 13849 PLr vs IEC 62061 SIL: choosing the right standard
Both are harmonised for machinery control systems and cover any technology. How they differ, how PL maps to SIL, and how to choose.
MSA Engineering Team · · 7 min read
Every safety function on a machine needs a defined level of reliability. In Europe, two harmonised standards can be used to specify and verify it: EN ISO 13849-1, which uses Performance Levels (PL a–e), and IEC 62061, which uses Safety Integrity Levels (SIL 1–3). Both give a presumption of conformity with the essential requirement on the safety and reliability of control systems.
So which should you use? The short answer: either is valid, but one will usually fit your project, your components and your customer better.
The common starting point
Both standards begin where EN ISO 12100 leaves off. The risk assessment identifies a hazard; a risk reduction measure depends on a control function; that function becomes a safety function with a required level of integrity. From there, both standards follow the same broad logic:
- Specify the safety function.
- Determine the required integrity (PLr or SIL).
- Design the control system architecture.
- Verify that the design achieves the required level, including systematic aspects and software.
- Validate the function on the real machine.
How they differ
| EN ISO 13849-1 | IEC 62061 | |
|---|---|---|
| Integrity measure | Performance Level, PL a–e | Safety Integrity Level, SIL 1–3 |
| Technologies | Any (electrical, hydraulic, pneumatic, mechanical) | Any, since Edition 2 (2021) |
| Determining the requirement | Risk graph: severity (S), frequency/duration of exposure (F), possibility of avoidance (P) | Severity (Se) plus a class from frequency/duration (Fr), probability of the hazardous event (Pr) and avoidance (Av) |
| Architecture | Designated architectures: Categories B, 1, 2, 3, 4 | Subsystem decomposition with basic subsystem architectures and architectural constraints |
| Quantification | MTTFd per channel, DCavg, CCF score → PL | PFH of each subsystem, summed for the function |
| Heritage | Evolved from EN 954-1 | Machinery-sector implementation of IEC 61508 |
Mapping PL to SIL
The link between the two is the average probability of a dangerous failure per hour (PFH):
| PL | PFH (per hour) | SIL equivalent |
|---|---|---|
| a | ≥ 10⁻⁵ to < 10⁻⁴ | — |
| b | ≥ 3 × 10⁻⁶ to < 10⁻⁵ | SIL 1 |
| c | ≥ 10⁻⁶ to < 3 × 10⁻⁶ | SIL 1 |
| d | ≥ 10⁻⁷ to < 10⁻⁶ | SIL 2 |
| e | ≥ 10⁻⁸ to < 10⁻⁷ | SIL 3 |
PFH is only part of the story. Achieving a PL or SIL also requires the right architecture, adequate diagnostics, protection against common cause failure, and measures against systematic faults. A component data sheet that says “PL e” does not make the function PL e.
When ISO 13849-1 is usually the better fit
- Typical machine safety functions — interlocked guards, emergency stops, light curtains, two-hand controls — that map cleanly onto designated architectures.
- Mixed technologies, especially pneumatics and hydraulics, where the Category approach is familiar and supplier data is widely available.
- Type-C standards that specify a PLr. If a machine-specific standard sets a required PL for a function, follow it.
- Teams and customers who already work in PL, so evidence is easy to review.
When IEC 62061 is usually the better fit
- Complex, programmable safety systems with many subsystems, networked devices and safety PLCs.
- Organisations with an IEC 61508 culture, or that supply into process industries where SIL is the common language.
- Customer specifications in SIL.
- Architectures that don’t match the designated Categories, where subsystem-level PFH calculation is more natural.
Can you mix them?
Yes. IEC 62061 allows subsystems designed to ISO 13849-1 to be integrated using their PL and PFH values, which is how certified PL-rated components are commonly used in SIL-rated functions. Likewise, ISO 13849-1 can use subsystems with SIL claims through their PFH values. What matters is that each safety function is verified consistently against one standard, and that the documentation makes the method clear.
Common pitfalls
- Skipping the safety requirements specification. Without a clear specification, verification and validation have nothing to verify against.
- Ignoring common cause failure. For Categories 2, 3 and 4, ISO 13849-1 requires a CCF score of at least 65 points.
- Forgetting systematic aspects and software. Both standards set requirements that go well beyond the hardware calculation.
- Confusing PFH with PFDavg. Machinery safety functions are typically high-demand (PFH). PFDavg belongs to low-demand process applications under IEC 61511.
- No validation evidence. ISO 13849-2 and the validation clause of IEC 62061 require documented analysis and testing — including fault injection — on the real machine.
Where MSA fits
MSA derives PLr / SIL for each safety function from the EN ISO 12100 risk assessment, keeps the calculation traceable to the hazard it addresses, and generates validation protocols, fault injection tests and device test records for each function. When an input changes, every affected calculation and document is regenerated.
This article is a summary for orientation. Always apply the current editions of EN ISO 13849-1/-2 and IEC 62061 in full.