IEC 62061– Safety integrity level (SIL)

IEC 62061 / EN IEC 62061 represents a sector-specific standard under IEC 61508. It describes the implementation of safety-related control systems on machinery and examines the whole lifecycle from the concept phase through to decommissioning.

The new edition of IEC 62061 was published in 2021. This new edition is not just an update of the existing standard. For a start, the standard is no longer limited to electrical systems but can be used for all types of technology, such as hydraulic or pneumatic systems for example.

In April 2022, IEC 62061 was published in the Official Journal of the EU as harmonised standard EN IEC 62061, the content being identical. As a result, presumption of conformity has officially come into force within the EU. A manufacturer can assume that he meets the health and safety requirements of the Machinery Directive if he complies with the provisions of the EU standard. In the conformity assessment procedure, he can issue the declaration of conformity and so affix the CE mark to his plant or machinery.

Presumption of conformity for the previous version EN 62061:2005 ends on 11 October 2023 at the latest! After this transition period, new declarations of conformity can only be issued on the basis of EN IEC 62061:2021.

The European Commission announced the newly harmonised standards on the EU website with CID 2022/ 621, dated April 2022. As of May 2022, they have not yet been published by the EU Commission in the informal "Summary List"!

Procedure for publishing harmonised standards in the EU

Important changes to IEC 62061 / EN IEC 62061:

• Changes to the methodology used to define the required SIL level
• The need to draft a Safety Requirements Specification
• The option to use devices developed in accordance with other standards
• More details on safety-related application software

IEC 62061 addresses the issue of how reliable a safety-related control system needs to be. In this case the estimation is based on a hybrid method, a combination of a matrix and a quantitative approach. It also addresses the validation of safety functions based on architectural and statistical methods.

As with EN ISO 13849-1, the objective is to establish the suitability of safety measures to reduce risks. Even with this standard, extensive calculations are required.

For each risk requiring a safety-related control system, the risk must be estimated and the risk reduction (SIL) defined, dependent on the control system. The risk associated with the safety function is estimated in accordance with IEC 62061, with consideration given to the following parameters:

• Severity of injury (Se)
• Frequency and duration of exposure (Fr)
• Probability of occurrence of a hazardous event (Pr)
• Probability of avoiding or limiting harm (Av)

Classification of severity (Se)

Classification of the frequency and duration of exposure (Fr)

Classification of probability (Pr)

Classification of probability of avoiding or limiting harm (Av)

Assignment matrix for determining the required SIL (or Plr) for a safety function

(Click on the graphic to enlarge it.)

EXAMPLE: For a specific hazard where Se = 3, Fr = 4, Pr = 5 and Av = 5, then:
Cl = Fr + Pr + Av = 4 + 5 + 5 = 14
Using this table would lead to a SIL 3 or PL e being assigned to the safety function that is intended to mitigate the specific hazard.

For each safety function it is necessary to identify the critical elements for performing the function, the so-called subsystems. The selection or design of these subsystems must cater for a SIL which is equal to or higher than the required level. The combination of all of these subsystems must also enable you to reach the required SIL.

Each subsystem must meet the following requirements:
- Architectural constraints for hardware safety integrity
- Probability of dangerous random hardware failures (PFH)
- Systematic safety integrity (requirements for avoiding failures and requirements for controlling systematic faults)

Architectural constraints of a subsystem

The SIL value that subsystems achieve is influenced by the architecture of the control system and the "Safe failure fraction" (SFF) or diagnostic level.

HFT: Hardware fault tolerance
SFF: Safe failure fraction

Requirements for the probability of dangerous random hardware failures

The probability of a dangerous failure of any safety-related control function (SRCF) as a result of dangerous random hardware failures shall be equal to or less than the failure threshold value defined in the safety requirements specification.

Further information:

Our experts will be happy to support you with the implementation of IEC 62061, thereby ensuring safe operation of your plant and machinery.

Pilz services for automation, plant and machinery safety