ISO 13849-1 and IEC 62061 can both support machinery safety-related control systems, but ISO 13849-1 uses Performance Levels while IEC 62061 uses Safety Integrity Levels.
The decision follows the machine risk assessment, safety-function complexity, subsystem technology, and the evidence needed to demonstrate that the required risk reduction has been achieved.
Two standards, one risk-reduction objective
EN ISO 13849-1:2023, Edition 4, and EN IEC 62061:2021, Edition 2, have similar scopes and pursue the same risk-reduction objective, but their design methodologies differ [S2]. Both are intended for machinery safety-related control systems, and both should be applied after the machine risk assessment has identified where risk reduction must be provided by a control system [S2][S5].
ISO 13849-1 organizes a safety-related control system into subsystems and evaluates categories and architectures at subsystem level, rather than assigning an architecture to the complete safety function as one block [S5]. IEC 62061 was developed as part of the broader IEC 61508 functional safety family and brings a probabilistic methodology to the machinery sector [S4].
The standards are not mutually exclusive in every architecture. EN IEC 62061 permits predesigned subsystems designed to EN ISO 13849-1 or IEC 61508, subject to the restrictions specified for the subsystem and its interface [S2]. This makes the standard named in the subsystem specification, the interface requirements, and the machine-level risk assessment more important than the slogan “choose one standard for the whole machine.”
Performance Level versus Safety Integrity Level
ISO 13849-1 provides Performance Levels PL a, PL b, PL c, PL d, and PL e, together with categories B, 1, 2, 3, and 4, while IEC 62061 provides machinery SIL 1, SIL 2, and SIL 3 [S4]. The two frameworks are commonly mapped as PL c to SIL 1, PL d to SIL 2, and PL e to SIL 3 [S4].
The required target is function-specific. ISO 13849-1 uses the required Performance Level, PLr, while IEC 62061 uses the required Safety Integrity, often called SILr [S2][S5]. Neither framework permits an engineer to select the desired level first and then design backward to justify it. The risk assessment establishes the required target; the calculation and validation then establish what the implementation achieves.
IEC 62061 applies to electrical, electronic, and programmable electronic safety-related control systems for machinery and excludes SIL 4 from its machinery scope [S4].
Choose ISO 13849-1 for technology-led designs
ISO 13849-1 is generally the more direct choice for conventional machine safety functions implemented with electromechanical or comparable subsystems, including guard interlocking, emergency stop, and safety-related stop functions [S4][S6]. Its category-and-architecture method is well suited to teams that can define the input, logic, and output subsystems and justify their category and Performance Level.
For example, an interlocked guard can be implemented through an interlock switch, while a stop command can de-energize a contactor or activate Safe Torque Off in a variable-speed drive [S5]. The standard’s scope is not limited to one device type, but the evidence becomes clearer when each subsystem has an identifiable architecture, diagnostic coverage, and failure behavior.
ISO 13849-1 is not the better choice merely because a design is familiar. A familiar technology still needs the correct PLr, category, diagnostic measures, series and parallel redundancy where applicable, and validated fault behavior. The standard’s complete technical revision in the 2023 Edition 4 also places renewed emphasis on a logical, iterative design process rather than only a final category calculation [S2].
Choose IEC 62061 for complex programmable systems
IEC 62061 suits more complex, high-functionality safety functions [S6]. Its methodology evaluates the safety-related control system through architecture, systematic capability, diagnostic coverage, and calculated failure probability within the IEC 61508 framework [S4].
The target is still derived from risk assessment, not selected from the controller’s capabilities.
Complex does not automatically mean IEC 62061. If the subsystem has already been designed and validated to a recognized machinery-safety standard, EN IEC 62061 can accept a predesigned subsystem based on EN ISO 13849-1 or IEC 61508, provided the applicable subsystem and interface restrictions are met [S2]. This is a practical route for mixing proven safety devices and validated programmable subsystems without forcing one architecture across every function.
Decision criteria for mixed machine portfolios
For a mixed portfolio, compare the standards on implementation method, required target, proof burden, subsystem compatibility, and maintainability rather than treating PL and SIL as the only criteria. The table below is a decision aid, not a substitute for the applicable standards or machine risk assessment. [S5]
Criterion | ISO 13849-1 | IEC 62061 Target | PL a to PL e | SIL 1 to SIL 3 for machinery Best fit | Conventional subsystem architectures and simpler safety functions | Complex E/E/PE or programmable safety-related control systems Primary proof | Category, architecture, diagnostic measures, and PFHd | Systematic capability, architecture, diagnostics, and PFH Mixed subsystems | Can supply validated subsystems to an IEC 62061 design within the applicable restrictions | Accepts predesigned EN ISO 13849-1 or IEC 61508 subsystems subject to stated restrictions [S2] Maintenance evidence | Preserve architecture and validate configuration changes | Preserve software, configuration, and subsystem-interface evidence [S2][S4]
For a typical machine with a handful of conventional guard functions, start with ISO 13849-1. For a large integrated production cell with coordinated safety logic, complex diagnostics, and substantial software configuration, IEC 62061 may provide the more natural evidence structure. If both approaches appear plausible, calculate the required target under the risk assessment first, then select the method that can produce defensible subsystem evidence with the least design distortion.
Applications, exclusions, and evidence limits
Both standards are appropriate when a hazard or hazardous situation originates from the machine itself or when a machine is being integrated into a larger system with safety-related interfaces [S7]. They apply to the safety-related control system, not to every part of a machine. Mechanical strength, guarding design, ergonomic risk, electrical installation, and other hazards still require their own applicable standards and risk-reduction measures.
Neither framework replaces hazard analysis. A protective device can reduce the likelihood of exposure but does not necessarily reduce the severity of the resulting injury, so guarding, preventive measures, and protective measures remain separate design decisions [S5]. Both frameworks also require attention to systematic failures rather than random hardware failures alone [S5].
Verification must follow the implemented architecture. For conventional functions, check the input, logic, and output categories, diagnostics, fault reaction, and PL achievement. For IEC 62061 systems, check the safety requirements specification, software lifecycle evidence, proven components, common-cause controls, systematic capability, PFH calculation, and validation. A device certificate alone does not prove that the complete machine safety function meets PLr or SILr [S1][S2].
Standards, testing, and procurement controls
The reference editions for a European conformity assessment are EN ISO 13849-1:2023, Edition 4, and EN IEC 62061:2021, Edition 2 [S2]. Both standards support conformity with applicable European machinery legislation, and C-type standards may permit either route [S2][S3]. The applicable legislation and the machine’s market jurisdiction must still be checked in the conformity assessment file.
Specify the standard and edition in safety requirements, subsystem purchase specifications, calculations, test plans, and validation records. Use the correct target notation, PLr for ISO 13849-1 or SILr for IEC 62061, and record the PFHd or PFH result for each safety function [S2][S5]. Independent functional-safety testing can review the design and evidence across the machinery lifecycle, including compliance and validation support [S1].
When purchasing safety relays, safety light curtains, or emergency-stop devices, require their declared safety function, standards, performance parameters, configuration limits, and interface conditions. Do not infer the machine-level required PL or SIL from a product family name; calculate each installed safety function after confirming the architecture.
Trackable decision signals for the next design review are the completed risk assessment, the PLr or SILr assigned to every safety function, the selected subsystem standard for each interface, and the calculated versus required reliability for every safety-related control system.