IEC 62061 SIL Levels: What They Actually Mean

SIL stands for Safety Integrity Level. IEC 62061 uses it to describe how reliably a safety function must work, expressed as a probability of dangerous failure per hour. That single number drives almost every architecture decision you will make on a safety-critical machine: single-channel or dual-channel, which safety PLC you can use, how often you need proof tests, and whether a simple safety relay cuts it or you need a full SIL-rated controller.

IEC 62061 applies specifically to electrical, electronic and programmable electronic safety-related control systems on machinery. It is the machinery-sector companion to IEC 61508, which is the broader functional-safety umbrella. If you are designing a safety function for a press, a robot cell, a conveyor line or any other machine covered by the Machinery Directive, IEC 62061 is the standard you reach for when the hazard involves control system failure.

IEC 62061 SIL Levels at a Glance

IEC 62061 defines three SIL levels for machinery: SIL 1, SIL 2 and SIL 3. Each maps to a target probability of dangerous failure per hour (PFH) for the entire safety function, from sensor through logic to actuator. SIL 4 exists in IEC 61508 but is explicitly excluded from IEC 62061 on the grounds that machinery applications should not require it. If your risk assessment pushes you toward SIL 4 territory, the standard says you need to redesign the machine, not the control system.

How You Determine the Required SIL

You do not pick a SIL level because it sounds appropriate. The required SIL comes out of a structured risk assessment. IEC 62061 Annex A gives you a method using three parameters: severity of the hazardous event (Se), frequency and duration of exposure (Fr), and probability of avoiding the harm (Av). You score each one, add them up, and read off the required SIL from a table. The standard calls the combined score the Class of Hazard (Cl).

• Severity (Se): scored 1 to 4, from reversible injury (1) to death (4).
• Frequency and duration (Fr): scored 1 to 5, from rare and short exposure (1) to continuous exposure (5).
• Probability of avoidance (Av): scored 1 to 5. A human cannot reliably stop a 500-tonne press once it strokes, so Av is high.
• Class = Fr + Av. You then look up Se vs Class in the Annex A table to get the required SIL.

Many engineers confuse the risk assessment output (required SIL) with the system design (achieved SIL). They are separate steps. You first determine what SIL you need, then you demonstrate your design achieves it. If you skip the risk assessment and just 'aim for SIL 2', you may be over-engineering a low-risk function or, worse, under-engineering a high-risk one.

Architecture and Hardware Fault Tolerance

IEC 62061 uses Hardware Fault Tolerance (HFT) to describe how many faults a subsystem can tolerate while still performing its safety function. HFT 0 means a single fault causes loss of the safety function. HFT 1 means one fault is tolerated, so you need at least two channels. The standard links HFT to SIL achievability through the Safe Failure Fraction (SFF) of each subsystem.

In practical terms, SIL 1 is often achievable with a single-channel architecture using a SIL 1-rated safety relay, provided the SFF of every subsystem is high enough. SIL 2 almost always pushes you to dual-channel, because the PFH budget is tight enough that a single-channel subsystem's SFF needs to be unrealistically high to stay within the target. SIL 3 essentially mandates HFT 1 plus additional diagnostic coverage, which is why you see triple-modular redundancy (TMR) or complex dual-channel architectures with cross-checking diagnostics in SIL 3 applications.

The PFH Budget: How Subsystems Add Up

The safety function runs from sensor to final actuator. Every subsystem in that chain contributes its own PFH. You sum them all, and the total must be below the SIL target. Manufacturers of SIL-rated components publish their PFH values in safety manuals. A typical SIL 2 Pilz PNOZ m safety PLC subsystem might contribute a PFH of around 1e-8 to 2e-8. A SIL 2 safety door switch might add another 5e-8. If you have three subsystems each at 4e-8, you are at 1.2e-7, which is comfortably inside the SIL 2 window.

Systematic Capability and Software

Random hardware failures are only half the picture. IEC 62061 also requires you to address systematic failures, meaning design errors, software bugs, specification mistakes and process failures. Each subsystem must have a Systematic Capability (SC) rating at least equal to the required SIL. SC is assigned by the component manufacturer through their own development process and certified by a third party like TÜV. You cannot calculate SC yourself from field data; it comes with the component's safety certificate.

For the safety PLC's application program, IEC 62061 applies a set of software requirements that scale with SIL level. At SIL 2 you need documented software lifecycle activities, structured programming practices, formal testing, and configuration management. At SIL 3 the requirements tighten further: formal methods, stricter module testing, and more rigorous validation. This is why safety PLC vendors like Siemens (with F-CPU and STEP 7 Safety), Rockwell (GuardLogix), Beckhoff (TwinSAFE) and Pilz (PSS 4000) provide dedicated safety programming environments that enforce some of these requirements automatically.

What SIL 2 Actually Costs in Practice

Engineers often ask what the real-world difference is between SIL 1 and SIL 2. Here is what changes when you step up:

• Dual-channel inputs: each E-stop button, gate switch or light curtain needs two independent output signals wired to separate input channels. You are now running twice the wire for every safety input device.
• Cross-monitoring: the safety logic controller must continuously compare the two channels and detect discrepancies within a defined time. This is built into certified safety PLCs but must be configured correctly, including the discrepancy time window.
• Actuator feedback: the safety function output (typically a safety relay or STO signal to a drive) needs a monitored feedback contact wired back to the controller to confirm it actually opened. This adds a feedback input for every output.
• Proof test interval: SIL 2 PFH calculations assume a proof test interval, commonly 1 year for machinery. You must schedule and document functional tests. If you skip them, the PFH claim is invalid.
• Validation evidence: you need documented verification and validation records. A site acceptance test checklist is not enough. You need test cases, expected results, actual results and sign-off.

None of this is exotic, but it does add panel space, wiring hours, commissioning time and ongoing maintenance overhead. Budget 30% to 50% more panel engineering time for a SIL 2 safety system compared to a basic safety relay circuit. That is real project cost, and it needs to be in the quote.

IEC 62061 vs ISO 13849: Which One Do You Use?

This question comes up constantly. Both standards apply to machinery safety functions. ISO 13849 uses Performance Level (PL a through e) as its metric, while IEC 62061 uses SIL. They are not identical but there is an approximate equivalence: PL c maps to SIL 1, PL d maps to SIL 2, and PL e maps to SIL 3. The main practical difference is scope. ISO 13849 was originally designed for non-programmable safety systems (relays, pneumatic valves, simple electronics) and extended to programmable systems in the 2006 revision. IEC 62061 was written from the ground up for programmable electronic systems and handles complex safety PLCs and networks more naturally. For a modern safety PLC controlling multiple safety functions across a fieldbus, IEC 62061 is usually the cleaner choice.

Common Mistakes in SIL Assessments

• Using component SIL rating as proof of system SIL. A SIL 2-rated sensor does not mean your safety function is SIL 2. You must calculate the whole chain.
• Ignoring common-cause failure (CCF). In a dual-channel system, both channels failing from the same root cause (a voltage spike, a contamination event, a wiring error) bypasses the redundancy entirely. IEC 62061 requires a CCF score of at least 65 points using Annex F. Separated wiring routes, different technologies, and proper shielding all contribute points.
• Not defining the safety function boundary. The standard requires you to state exactly what the safety function does, under what conditions it must activate, and what the safe state is. Without this, you cannot calculate anything.
• Assuming the safety PLC handles everything. The PLC logic is only one subsystem. If your E-stop switch has no SIL rating and an unknown PFH, the whole calculation is meaningless.
• Setting the proof test interval to infinity. Every published PFH figure assumes a proof test interval. If you set it to 20 years but the calculation assumed 1 year, the actual PFH is higher than you think.

Getting Started: What You Need on Your Desk

To do a proper IEC 62061 assessment you need: the standard itself (buy it, do not rely on summaries), safety manuals for every component in the safety function (most major manufacturers publish these free, including Sick, Pilz, Siemens, Rockwell, Schmersal and Euchner), a spreadsheet or dedicated tool to track the PFH budget, and a documented risk assessment before you start any hardware selection. SISTEMA from the IFA (Institut für Arbeitsschutz) is a free tool widely used in Europe and it now supports IEC 62061 calculations alongside ISO 13849.

SIL work is one of those areas where the documentation is genuinely important, not just a box-ticking exercise. If there is ever an incident, the regulator will ask for your risk assessment, your SIL calculation, your validation records, and your proof test logs. If any of those are missing, the fact that the hardware was SIL 2-rated buys you almost nothing.