Functional safety: choosing between PL and SIL
Functional safety is the discipline of making sure a safety function still works when something breaks. Not that the machine is safe when everything is fine — that a guard interlock, an emergency stop or a light curtain performs correctly when a component fails, a wire shorts, or a controller misbehaves.
For a machine going to Europe, this is where an otherwise well-designed system most often fails review: not because the safety function is missing, but because nobody can demonstrate how reliable it is.
One framework, two routes for machinery
IEC 61508 is the generic functional safety standard, applied across automotive, machinery, process, railway and aerospace. It is the parent, and it is rarely what you apply directly to a machine.
For machinery there are two harmonised routes, and they are alternatives, not stages:
EN ISO 13849 — Performance Levels (PL). Suited to applications with defined architectures and typical industrial risks. It works from categories of architecture, component reliability data, diagnostic coverage and common-cause failure, and produces a Performance Level from a to e. It handles mixed technology — mechanical, hydraulic, pneumatic, electrical — in one framework, which is why most machine builders live here.
EN IEC 62061 — Safety Integrity Levels (SIL). Also written for machinery, but built around electrical, electronic and programmable electronic systems. It produces a SIL 1 to 3 and is the better fit when the safety function is substantially a matter of electronics and software.
Which one applies to your project is a decision, and it is yours to make — with consequences for how you gather evidence, which component data you need from suppliers, and what your validation looks like. Making it late, or making it twice, is expensive.
What transfers from your U.S. work
More than most people expect — and less than the paperwork suggests.
The engineering transfers. Risk assessment methodology, the logic of selecting protective measures, the architecture of a dual-channel circuit with monitoring: none of that is different because the machine crossed an ocean. If you work to the U.S. machine safety standards, you have already done most of the thinking, and the concepts of Performance Level and Safety Integrity Level are not foreign to them.
The evidence usually does not. What Europe asks for is a demonstrable, calculated reliability figure for each safety function, supported by component data, diagnostic coverage and validation records — assembled in the form the harmonised standard expects. A safety circuit that is correct but undocumented has no PL and no SIL, and for conformity purposes that is the same as not having one.
The honest summary: you are likely to be closer than you fear on design and further than you hope on evidence. Which of the two is true for a given machine is exactly what an early review tells you.
Why this gets harder in 2027
The Machinery Regulation puts functional safety at the centre of two of its biggest changes.
Fact — check it yourself
Safety functions that learn.
Safety components — and machinery with embedded systems — whose safety functions use fully or partially self-evolving machine-learning behaviour are in the category where a Notified Body is mandatory, whatever standards you built to. If a safety function adapts its own behaviour, it cannot be validated once and left alone, and the Regulation now says so.
Reg. (EU) 2023/1230, Annex I Part A, points 5–6 · art. 25(2)
Fact — check it yourself
Safety software becomes part of the file.
The technical documentation must include the source code or programming logic of safety-related software, providable to a national authority on reasoned request. If your safety logic is in a PLC program, that program needs versioning and traceability for ten years.
Reg. (EU) 2023/1230, Annex IV, Part A, point (m)
Fact — check it yourself
And cybersecurity becomes a safety requirement.
Control systems must withstand foreseeable malicious attempts, and hardware and software whose corruption could cause a hazard must be protected against corruption that is intentional as well as accidental. A safety function that can be defeated remotely is a functional safety problem, not just an IT one.
Reg. (EU) 2023/1230, Annex III, 1.1.9 and 1.2.1
What we do
We support the design, analysis and validation of safety-related control systems and components: selecting the route, defining the required performance for each safety function, doing the calculation, and producing validation evidence that stands up inside the technical file.
Not sure which standard applies to your project? We specialise in machinery, and choosing the right approach at the start costs nothing compared with discovering it at validation.