Functional Safety in Machinery

No. ISO 26262 addresses electrical and electronic systems in road vehicles, while machinery safety in Europe is governed by product law, the Machinery Directive and the Machinery Regulation that succeeds it, with harmonized standards supporting a presumption of conformity. The control-system standards are ISO 13849-1 and IEC 62061, sitting on top of ISO 12100 for risk assessment. The two worlds ask similar engineering questions and answer them with different vocabularies, which is why three chapters of this guide are devoted to comparing them properly instead of assuming they map.

They are two B1 standards for the same job with different ancestries. ISO 13849-1 descends from the older machinery categories tradition and adds reliability data and diagnostic coverage on top of designated architectures, producing a Performance Level from a to e, and it covers safety functions in any technology including hydraulics and pneumatics. IEC 62061 adapts the IEC 61508 approach for machinery, works with subsystems and SIL claims, and speaks the vocabulary that electronics suppliers publish in. Both express the result as a dangerous failure frequency for high or continuous demand, which is what lets them be compared at all.

The target attaches to a specific safety function, not to a machine. The ISO 13849 route turns the risk elements from the ISO 12100 assessment into three questions about severity, frequency and duration of exposure, and the possibility of avoiding the harm, and reads the required Performance Level from the resulting path. IEC 62061 reaches its target arithmetically instead, scoring severity against a class assembled from exposure, probability and avoidance. The guide walks both routes with worked scenarios and is explicit that the questions are deliberately coarse, so the reasoning behind each answer has to be written down.

They are designated reference structures, each with a defined answer to what happens when a component fails: a baseline single channel, an improved single channel built from well-tried components and principles, a tested single channel where diagnostics run on an interval, and two dual-channel structures that differ in how thoroughly they handle a single fault and the accumulation of faults. The category alone settles nothing, because the same structure lands on different Performance Levels depending on channel reliability and diagnostic coverage, and every category from the tested one upward leans on independence claims that the common-cause measures have to earn.

No, and the guide is blunt about it. A Performance Level is a required target for one machine safety function that bundles architecture, reliability, diagnostic coverage, common-cause measures and systematic process measures into one composite claim. An ASIL is assigned to a hazardous event and then inherited by its safety goal and downstream requirements. The probability metrics on each side share a unit but not their scope, derivation or claim. When a component certificate from one world is offered in the other, the honest move is to check its evidence against the receiving standard rather than translating letters.

It runs 15 chapters: the nature of mechanical harm and the stored energy that outlives a stop command, machinery as product law and the A-B-C standards system, ISO 12100 risk assessment and the three-step method, the two routes to a PLr or SIL target, the safety function as a real device chain including safety distance from stopping time, the five designated categories, the reliability arithmetic behind a claim, the technology from safety relays to safe drives and safe fieldbuses, software rules and validation, the process from risk assessment to CE mark, a fully computed robot cell, three chapters comparing machinery with ISO 26262 across risk models, metrics and process, and a closing one-page summary of the whole discipline.