Title: Functional Safety in Machinery | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/machinery-safety Description: How machines that can crush, cut and entangle are engineered so they do not: ISO 12100 risk assessment, PLr and SIL targets, the five ISO 13849 categories, MTTFd, DCavg, CCF and PFHd, safe motion and safe fieldbuses, validation, the CE route, and three chapters comparing the machinery model with ISO 26262. --- Concept guide · ISO 12100, ISO 13849-1, IEC 62061 · 15 chapters # Functional Safety in Machinery The complete machinery control-safety path: ISO 12100 risk assessment, a PLr or SIL target, a designated architecture, the arithmetic that proves it, validation, the CE file, and an honest comparison with ISO 26262. 15 Chapters 5 ISO 13849 categories 3 Machinery versus automotive chapters 1 Worked robot cell Included in Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fmachinery-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **The Machine Next to You** 2. 02 **The Rulebook: Directives and the A-B-C Standards** 3. 03 **Risk Assessment and the Three-Step Method** 4. 04 **From Risk to Target: PLr and SIL** 5. 05 **The Safety Function: Sensor, Logic, Actuator** The short version ## Quick answers Does ISO 26262 apply to machinery? No. ISO 26262 addresses electrical and electronic systems in road vehicles, while machinery safety in Europe is governed by product law, the Machinery Directive and the Machinery Regulation that succeeds it, with harmonized standards supporting a presumption of conformity. The control-system standards are ISO 13849-1 and IEC 62061, sitting on top of ISO 12100 for risk assessment. The two worlds ask similar engineering questions and answer them with different vocabularies, which is why three chapters of this guide are devoted to comparing them properly instead of assuming they map. What is the difference between ISO 13849-1 and IEC 62061? They are two B1 standards for the same job with different ancestries. ISO 13849-1 descends from the older machinery categories tradition and adds reliability data and diagnostic coverage on top of designated architectures, producing a Performance Level from a to e, and it covers safety functions in any technology including hydraulics and pneumatics. IEC 62061 adapts the IEC 61508 approach for machinery, works with subsystems and SIL claims, and speaks the vocabulary that electronics suppliers publish in. Both express the result as a dangerous failure frequency for high or continuous demand, which is what lets them be compared at all. Keep going, free - [Article · 8 min read Automotive vs Machinery Functional Safety: An ISO 26262 Comparison](https://iso26262.academy/blog/automotive-vs-machinery-functional-safety-iso-26262-comparison) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course ## Why it pays for itself ### One continuous path, not scattered clauses Risk assessment, target setting, architecture, arithmetic, technology, software, validation and the conformity file are taught as one chain, so every chapter hands the next the artifact it needs and you can see where a claim would break. ### The arithmetic made visible Channel reliability, weighted diagnostic coverage, common-cause measures and the resulting failure probability are worked on real chains, including the wear parts and blind spots that only appear once the numbers are actually assembled. ### A cross-domain comparison that holds up Three dedicated chapters set the machinery model against ISO 26262 across risk, metrics and process, and they name precisely where equivalence claims between Performance Levels and ASILs stop being true. After the course ## What you’ll be able to do ### Run an ISO 12100 Risk Assessment in the Right Order Set the limits of the machine, identify hazards task by task across the whole life including the non-routine tasks that own the accident record, and apply the three-step hierarchy without skipping to guarding. ### Set a Defensible PLr or SIL Target Walk the risk graph or the additive class assignment for a specific safety function, justify each parameter choice, and read both results against the same failure probability axis. ### Choose an Architecture That Matches the Target Pick among the designated categories with a clear view of what each does about a single fault, what the tested channel cannot cover, and what redundancy quietly assumes about independence. ### Produce the Numbers Behind the Claim Assemble channel reliability, weighted diagnostic coverage and common-cause measures into a Performance Level claim, and schedule the wear parts your own arithmetic exposes. ### Validate the Machine and Verify the Geometry Attack the design with its own fault list, measure the real stopping time at commissioning, and confirm that the mounting distance the calculation assumed still holds on the actual machine. ### Work Across Machinery and Automotive Without Faking Equivalence Compare the two risk models, metric systems and process ecosystems accurately, refuse the letter-to-letter translations that sales decks offer, and re-argue evidence in the receiving standard. The curriculum · 15 chapters ## Chapter by chapter 1. 01 **The Machine Next to You** Why machinery safety is its own discipline: a person and raw mechanical energy share the room every working day. The named taxonomy of mechanical harm, two centuries of the same lesson, and the stored energy that keeps a stopped machine dangerous. - Hazard taxonomy - Stored energy after the stop - The standstill safe state 2. 02 **The Rulebook: Directives and the A-B-C Standards** Machinery safety as product law: the Machinery Directive and the Machinery Regulation that replaces it, harmonized standards and the presumption of conformity, the A, B and C standard types with their precedence, and how ISO 13849-1 and IEC 62061 came to coexist. - CE marking and product law - A-B-C precedence - Two standards, one job 3. 03 **Risk Assessment and the Three-Step Method** The ISO 12100 work that happens before any electronics exist: limits of the machine, hazard identification task by task across the whole life, severity plus a three-part probability, and the strict order of inherently safe design, then safeguarding, then information for use. - Limits of the machine - Task-based hazards - Hierarchy in strict order 4. 04 **From Risk to Target: PLr and SIL** Two routes from the same risk elements to one axis: the ISO 13849 risk graph with its three questions, the IEC 62061 severity plus additive class assignment, why both land on a failure probability per hour, and what a target does not yet tell you. - Risk graph walk - Additive class assignment - One PFH axis 5. 05 **The Safety Function: Sensor, Logic, Actuator** The chain as real devices: interlocking devices and their defeat problem, electro-sensitive protective equipment, two-hand controls, the emergency stop put in its proper place, logic generations, contactors and drive-integrated stopping, and how response time becomes a safety distance. - The input device zoo - Stop categories on one clock - Distance from stopping time 6. 06 **Architecture: The Five Categories** The designated reference structures and their different answers to a single component failure: single channel, tested channel and its unclosable window, redundancy with and without fault accumulation, and the common-cause and fault-exclusion obligations that police every claim. - Five designated structures - The test window - CCF and fault exclusion 7. 07 **The Numbers: MTTFd, DC, CCF and PFHd** The reliability arithmetic behind a Performance Level claim: where component figures come from and how cycle rate converts them, the defined MTTFd bands and the deliberate honesty cap, failure-rate-weighted diagnostic coverage, and the same question posed the IEC 62061 way. - Component data to channel figures - Weighted DCavg - Subsystem composition 8. 08 **Technology: Relays, Safety PLCs, Drives and Fieldbuses** The hardware the categories are made of: the safety relay wiring pattern and its feedback loop, safety PLCs that move redundancy inside the silicon, standardized safe motion functions in the drive, safe communication over an untrusted network, fluid power, and the deliberate holes called muting and blanking. - Relay pattern and EDM - Safe motion functions - Black channel on the fieldbus 9. 09 **Software and Validation** Which rules your code lives under depending on who wrote it and in what language, the simplified V for application software, the certified-block trap that hides bypasses, validation as hostile testing against the machine's own fault list, and the commissioning stopwatch. - Authorship decides the regime - Certified-block trap - Measured versus assumed stop time 10. 10 **Process: From Risk Assessment to CE Mark** The paper machine around the metal one: how every chapter turned into a document, the conformity route fork, the actor map from component supplier through integrator and employer, the substantial-modification tripwire, and how self-declared paperwork fails in practice. - Artifact chain to the CE plate - The actor map - Modification tripwire 11. 11 **Worked Example: The Robot Cell** Ten chapters of method applied to one machine with every number shown: tasks against hazards, three safety functions with their target walks, the engineered chains and their computed verdicts, the safety distance checked on the plan, and the residual risk teach mode leaves behind. - Task and hazard grid - Three functions computed - The residual nobody closes 12. 12 **Machinery vs Automotive: Risk Models** The risk graph held against the HARA: who each model protects, why exposure is designed in on one side and priced on the other, the different human credit each grants, the conservatism each builds in on purpose, and what genuinely transfers between them. - Two exposure regimes - Human credit compared - What does not transfer 13. 13 **Machinery vs Automotive: Metrics and Mechanisms** Similar inverse-hour scales carrying different claims: function-level against item-level probability metrics, assigned diagnostic coverage against measured coverage, the latent-fault question one side gives a metric and the other handles structurally, and where each world puts its safe state. - One axis, three vocabularies - Coverage cousins - De-energize versus degrade 14. 14 **Machinery vs Automotive: Process and Ecosystem** Two legal machines and two evidence cultures: a self-issued conformity signature against an argued and assessed safety case, composing certificates against proving elements in context, independence by law against independence by degree, and change as a work order against change as a release. - Declaration versus safety case - Evidence cultures - What each side should steal 15. 15 **The One-Page Story** The whole discipline compressed onto a single poster: the stages from hazard to CE plate with the validation loop drawn in, the reference tables worth keeping, and ten sentences that carry the argument when a colleague asks what all of this says. - Hazard to CE plate - Reference tables - Ten sentences Built for ## Who this guide is for - Automotive safety engineers who now own production equipment, test rigs or plant machinery - Machine builders and integrators responsible for a technical file and a Declaration of Conformity - Control engineers designing interlocks, light curtain functions and safe motion chains - Robotics and automation engineers assessing cells where people share the workspace - Safety managers working across ISO 26262 and machinery standards in the same organization ## Frequently Asked Questions Common questions about Functional Safety in Machinery The target attaches to a specific safety function, not to a machine. The ISO 13849 route turns the risk elements from the ISO 12100 assessment into three questions about severity, frequency and duration of exposure, and the possibility of avoiding the harm, and reads the required Performance Level from the resulting path. IEC 62061 reaches its target arithmetically instead, scoring severity against a class assembled from exposure, probability and avoidance. The guide walks both routes with worked scenarios and is explicit that the questions are deliberately coarse, so the reasoning behind each answer has to be written down. They are designated reference structures, each with a defined answer to what happens when a component fails: a baseline single channel, an improved single channel built from well-tried components and principles, a tested single channel where diagnostics run on an interval, and two dual-channel structures that differ in how thoroughly they handle a single fault and the accumulation of faults. The category alone settles nothing, because the same structure lands on different Performance Levels depending on channel reliability and diagnostic coverage, and every category from the tested one upward leans on independence claims that the common-cause measures have to earn. No, and the guide is blunt about it. A Performance Level is a required target for one machine safety function that bundles architecture, reliability, diagnostic coverage, common-cause measures and systematic process measures into one composite claim. An ASIL is assigned to a hazardous event and then inherited by its safety goal and downstream requirements. The probability metrics on each side share a unit but not their scope, derivation or claim. When a component certificate from one world is offered in the other, the honest move is to check its evidence against the receiving standard rather than translating letters. It runs 15 chapters: the nature of mechanical harm and the stored energy that outlives a stop command, machinery as product law and the A-B-C standards system, ISO 12100 risk assessment and the three-step method, the two routes to a PLr or SIL target, the safety function as a real device chain including safety distance from stopping time, the five designated categories, the reliability arithmetic behind a claim, the technology from safety relays to safe drives and safe fieldbuses, software rules and validation, the process from risk assessment to CE mark, a fully computed robot cell, three chapters comparing machinery with ISO 26262 across risk models, metrics and process, and a closing one-page summary of the whole discipline. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fmachinery-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)