IEC 62061:2005/AMD1:2012

IEC 62061 ®
Edition 1.0 2012-11
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
AMENDMENT 1
AMENDEMENT 1
Safety of machinery – Functional safety of safety-related electrical, electronic
and programmable electronic control systems

Sécurité des machines – Sécurité fonctionnelle des systèmes de commande
électriques, électroniques et électroniques programmables relatifs à la sécurité

IEC 62061:2005/A1:2012
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester.
If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,
please contact the address below or your local IEC member National Committee for further information.

Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite ni
utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie et les
microfilms, sans l'accord écrit de la CEI ou du Comité national de la CEI du pays du demandeur.
Si vous avez des questions sur le copyright de la CEI ou si vous désirez obtenir des droits supplémentaires sur cette
publication, utilisez les coordonnées ci-après ou contactez le Comité national de la CEI de votre pays de résidence.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

Useful links:
IEC publications search - www.iec.ch/searchpub Electropedia - www.electropedia.org
The advanced search enables you to find IEC publications The world's leading online dictionary of electronic and
by a variety of criteria (reference number, text, technical electrical terms containing more than 30 000 terms and
committee,…). definitions in English and French, with equivalent terms in
It also gives information on projects, replaced and additional languages. Also known as the International
withdrawn publications. Electrotechnical Vocabulary (IEV) on-line.

IEC Just Published - webstore.iec.ch/justpublished Customer Service Centre - webstore.iec.ch/csc
Stay up to date on all new IEC publications. Just Published If you wish to give us your feedback on this publication
details all new publications released. Available on-line and or need further assistance, please contact the
also once a month by email. Customer Service Centre: csc@iec.ch.

A propos de la CEI
La Commission Electrotechnique Internationale (CEI) est la première organisation mondiale qui élabore et publie des
Normes internationales pour tout ce qui a trait à l'électricité, à l'électronique et aux technologies apparentées.

A propos des publications CEI
Le contenu technique des publications de la CEI est constamment revu. Veuillez vous assurer que vous possédez
l’édition la plus récente, un corrigendum ou amendement peut avoir été publié.

Liens utiles:
Recherche de publications CEI - www.iec.ch/searchpub Electropedia - www.electropedia.org
La recherche avancée vous permet de trouver des Le premier dictionnaire en ligne au monde de termes
publications CEI en utilisant différents critères (numéro de électroniques et électriques. Il contient plus de 30 000
référence, texte, comité d’études,…). termes et définitions en anglais et en français, ainsi que
Elle donne aussi des informations sur les projets et les les termes équivalents dans les langues additionnelles.
publications remplacées ou retirées. Egalement appelé Vocabulaire Electrotechnique
International (VEI) en ligne.
Just Published CEI - webstore.iec.ch/justpublished
Service Clients - webstore.iec.ch/csc
Restez informé sur les nouvelles publications de la CEI.
Just Published détaille les nouvelles publications parues. Si vous désirez nous donner des commentaires sur
Disponible en ligne et aussi une fois par mois par email. cette publication ou si vous avez des questions
contactez-nous: csc@iec.ch.
IEC 62061 ®
Edition 1.0 2012-11
INTERNATIONAL
STANDARD
NORME
INTERNATIONALE
AMENDMENT 1
AMENDEMENT 1
Safety of machinery – Functional safety of safety-related electrical, electronic

and programmable electronic control systems

Sécurité des machines – Sécurité fonctionnelle des systèmes de commande

électriques, électroniques et électroniques programmables relatifs à la sécurité

INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
COMMISSION
ELECTROTECHNIQUE
PRICE CODE
INTERNATIONALE
CODE PRIX J
ICS 13.110; 25.040.99; 29.020 ISBN 978-2-83220-441-2

– 2 – 62061 Amend. 1  IEC:2012
FOREWORD
This amendment has been prepared by IEC technical committee 44: Safety of machinery –
Electrotechnical aspects.
The text of this amendment is based on the following documents:
CDV Report on voting
44/655/CDV 44/663/RVC
Full information on the voting for the approval of this amendment can be found in the report
on voting indicated in the above table.
The committee has decided that the contents of this amendment and the base publication will
remain unchanged until the stability date indicated on the IEC web site under
"http://webstore.iec.ch" in the data related to the specific publication. At this date, the
publication will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
_____________
INTRODUCTION
Delete the tenth paragraph of this clause.
Delete the following text below Figure 1:
Information on the recommended application of IEC 62061 and ISO 13849-1
(under revision)
Replace the text of the paragraph above Table 1 by the following:
IEC 62061 and ISO 13849-1 specify requirements for the design and implementation of
safety-related control systems of machinery. The use of either of these standards, in
accordance with their scopes, can be presumed to fulfil the relevant essential safety
requirements. IEC/TR 62061-1 provides guidance on the application of IEC 62061 and
ISO 13849-1 in the design of safety-related control systems for machinery.
Delete the note above Table 1.
Delete Table 1.
1 Scope
Replace the text of Note 2 by the following:
NOTE 2 In this standard, it is presumed that the design of complex programmable electronic subsystems or
subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see
H
IEC 61508-2:2010, 7.4.4.2). It is considered that Route 2H (see IEC 61508-2:2010, 7.4.4.3) is not suitable for

62061 Amend. 1  IEC:2012 – 3 –
general machinery. Therefore, this standard does not deal with Route 2 . This standard provides a methodology for
H
the use, rather than development, of such subsystems and subsystem elements as part of a SRECS.
2 Normative references
Replace the references to ISO 12100-1:2003 and ISO 12100-2:2003 by the following new
reference:
ISO 12100:2010, Safety of machinery – General principles for design – Risk assessment and
risk reduction
Replace the existing reference to ISO 13849-1 by the following new reference:
ISO 13849-1:2006, Safety of machinery – Safety-related parts of control systems – Part 1:
General principles for design
3.2.5
subsystem
Replace definition 3.2.5 by the following new definition:
3.2.5
subsystem
entity of the top-level architectural design of the SRECS where a dangerous failure of any
subsystem will result in a dangerous failure of a safety-related control function
[IEC 61508-4, 3.4.4 modified]
NOTE 1 A complete subsystem can be made up from a number of identifiable and separate subsystem elements,
which when put together implement the function blocks allocated to the subsystem.
NOTE 2 This differs from common language where “subsystem” may mean any sub-divided part of an entity, the
term “subsystem” is used in this standard within a strongly defined hierarchy of terminology: “subsystem” is the first
level subdivision of a system. The parts resulting from further subdivision of a subsystem are called “subsystem
elements”.
3.2.7
low complexity component
Replace the reference above Note 1 by the following new reference:
[IEC 61508-4, 3.4.3 modified]
3.2.9
functional safety
Replace the reference by the following new reference:
[IEC 61508-4, 3.1.12 modified]
3.2.10
hazard (from machinery)
Replace the reference by the following new reference:
[ISO 12100, 3.6 modified]
3.2.11
hazardous situation
Replace the reference by the following new reference:
[ISO 12100, 3.10 modified]
– 4 – 62061 Amend. 1  IEC:2012
3.2.12
protective measure
Replace the reference by the following new reference:
[ISO 12100, 3.19 modified]
3.2.13
risk
Replace the reference by the following new reference:
[ISO 12100, 3.12]
3.2.15
safety function
Replace the reference by the following new reference:
[ISO 12100, 3.30]
3.2.19
safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.4 modified]
3.2.20
hardware safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.7 modified]
3.2.21
software safety integrity
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.5 modified]
3.2.22
systematic safety integrity
Replace the reference by the following new reference:

[IEC 61508-4, 3.5.6 modified]
3.2.23
Safety Integrity Level
SIL
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.8 modified]
3.2.26
low demand mode
Replace the first paragraph by the following new paragraph:
mode of operation in which the frequency of demands on a SRECS is no greater than one per
year
3.2.27
high demand or continuous mode
Replace the first paragraph by the following new paragraph:

62061 Amend. 1  IEC:2012 – 5 –
mode of operation in which the frequency of demands on a SRECS is greater than one per
year or the SRCF retains the machine in a safe state as part of normal operation
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.16 modified]
3.2.28
Probability of dangerous Failure per Hour
PFH
D
Replace definition 3.2.28 by the following new definition:
3.2.28
Probability of dangerous Failure per Hour
PFH
D
average probability of a dangerous failure per hour of a safety related system/subsystem to
perform the specified safety function over a given period of time
NOTE PFH should not be confused with probability of dangerous failure on demand (PFD).
D
3.2.29
target failure value
Replace the reference by the following new reference:
[IEC 61508-4, 3.5.17 modified]
3.2.35
architecture
Replace the reference by the following new reference:
[IEC 61508-4, 3.3.4 modified]
3.2.37
proof test
Replace the first paragraph by the following new paragraph:
periodic test performed to detect dangerous hidden failures and degradation in a SRECS and
its subsystems so that, if necessary, the SRECS and its subsystems can be restored to an “as
new” condition or as close as practical to this condition
3.2.38
diagnostic coverage
Replace the first paragraph by the following new paragraph:
fraction of dangerous failures detected by automatic on-line diagnostic tests
Add, at the end of this subclause, new Note 2 as follows:
NOTE 2 The fraction of detected dangerous failures is computed to be the rate of dangerous failures that are
detected by automatic on-line diagnostic tests divided by the rate of total dangerous failures.
and number the existing note as Note 1.
3.2.40
dangerous failure
Delete the reference “[IEC 61508-4, 3.6.7 modified]”.
3.2.41
safe failure
Delete the reference “[IEC 61508-4, 3.6.8 modified]”.

– 6 – 62061 Amend. 1  IEC:2012
3.2.43
Common Cause Failure
CCF
Replace, in the first paragraph, the word “coincident” by “concurrent”.

5.2.3 Functional requirements specification for SRCFs
Replace the existing text of this subclause (including 5.2.3.1 and 5.2.3.2) by the following:
The functional requirements specification for SRCFs shall describe details of each SRCF to
be performed including, as applicable:
– the condition(s) (e.g. operating mode) of the machine in which the SRCF shall be active or
disabled;
– the priority of those functions that can be simultaneously active and that can cause
conflicting action;
– the frequency of operation of each SRCF;
– the required response time of each SRCF;
– the interface(s) of the SRCFs to other machine functions;
– the required response times (e.g. input and output devices);
– a description of each SRCF;
– a description of fault reaction function(s) and any constraints on, for example, re-starting
or continued operation of the machine in cases where the initial fault reaction is to stop
the machine;
– a description of the operating environment (e.g. temperature, humidity, dust, chemical
substances, mechanical vibration and shock);
– tests and any associated facilities (e.g. test equipment, test access ports);
– rate of operating cycles, duty cycle, and/or utilisation category, for electromechanical
devices intended for use in the SRCF.
NOTE 1 In addition to the requirements of IEC 61000-6-2, when a SRECS is intended for use in an industrial
environment, electromagnetic (EM) immunity levels are given in IEC 61326-3-1. SRECS intended for use in another
EM environment (e.g. residential) should have immunity levels based on those specified in different EMC standards
(e.g., for a residential environment, IEC 61000-6-1).
NOTE 2 When specifying EM immunity levels it is necessary to consider whether the levels used in different EMC
standards cover cases which can occur in a SRECS application even with a low probability of occurrence.
NOTE 3 EM immunity performance criterion for functional safety of a SRECS is given in 6.4.3.

6.4 Requirements for systematic safety integrity of the SRECS
Delete the note.
6.4.2 Requirements for the control of systematic faults
Replace Note 2 by the following:
NOTE 2 Further information can be found in IEC 61784-3 and IEC 61508-2.
6.4.3 Electromagnetic (EM) immunity
Replace, in this subclause, “Annex E” by “IEC 61326-3-1”.

62061 Amend. 1  IEC:2012 – 7 –
Replace, in the note of this subclause, “Annex E” by “IEC 61326-3-1”.
6.6.3.1 General
Replace the last sentence of this subclause by the following:
The SIL that can be achieved by the SRECS is less than or equal to the lowest SILCLs of any
of the subsystems that comprise the SRECS.
6.6.3.4 Systematic safety integrity
Delete subclause 6.6.3.4.
6.7.2.1
Replace this subclause by the following:
6.7.2.1 The subsystem shall be realised by either selection (see 6.7.3) or design (see 6.7.4)
in accordance with its safety requirements specification (see 6.6.2.1.7), taking into account all
the requirements of 6.2. Subsystem(s) incorporating complex components shall comply with
IEC 61508-2 and IEC 61508-3 as appropriate for the required SIL and the design shall use
Route 1 (see IEC 61508-2:2010, 7.4.4.2).
H
EXCEPTION: Where a subsystem design includes a complex component as a subsystem
element, 6.7.4.2.3 is applicable.
NOTE In this standard, it is presumed that the design of complex programmable electronic subsystems or
subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see IEC 61508-
H
2:2010, 7.4.4.2). It is considered that Route 2 (see IEC 61508-2:2010, 7.4.4.3) is not suitable for general
H
machinery. Therefore, this standard does not deal with Route 2H. This standard provides a methodology for the
use, rather than development, of such subsystems and subsystem elements as part of a SRECS.
6.7.2.2
Replace Note 1 of item b) by the following:
NOTE 1 For electromechanical subsystems, the probability of failure should be estimated taking into account the
number of operating cycles declared by the manufacturer and the duty cycle (see 5.2.3). This information should be
based upon a B10 value (see IEC 61649) under the operating conditions stated by the manufacturer. See for
example IEC 60947-4-1, Annex K.
6.7.3.2
Add the following text at the end of the first sentence:
and the design shall use Route 1 (see IEC 61508-2:2010, 7.4.4.2).
H
Add the following note at the end of the subclause:
NOTE In this standard, it is presumed that the design of complex programmable electronic subsystems or
subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see
H
IEC 61508-2:2010, 7.4.4.2). It is considered that Route 2 (see IEC 61508-2:2010, 7.4.4.3) is not suitable for
H
general machinery. Therefore, this standard does not deal with Route 2 . This standard provides a methodology for
H
the use, rather than development, of such subsystems and subsystem elements as part of a SRECS.
6.7.4.2.2
Replace, in the second dashed item of item b), “7.4.7.5 to 7.4.7.12” by “7.4.10”.
6.7.4.2.3
Replace this subclause by the following:

– 8 – 62061 Amend. 1  IEC:2012
6.7.4.2.3 Where the design of a subsystem incorporates a complex component (as a
subsystem element) which satisfies all relevant requirements of IEC 61508-2 and
IEC 61508-3 in relation to the SILCL and uses Route 1 (see IEC 61508-2:2010, 7.4.4.2), it
H
can be considered as a low complexity component in the context of a subsystem design since
its relevant failure modes, behaviour on detection of a fault, rate of failure, and other safety-
related information are known. Such components shall only be used in accordance with their
specification and the relevant information for use provided by their supplier.
NOTE In this standard, it is presumed that the design of complex programmable electronic subsystems or
subsystem elements conforms to the relevant requirements of IEC 61508 and uses Route 1 (see
H
IEC 61508-2:2010, 7.4.4.2). It is considered that Route 2 (see IEC 61508-2:2010, 7.4.4.3) is not suitable for
H
general machinery. Therefore, this standard does not deal with Route 2 . This standard provides a methodology for
H
the use, rather than development, of such subsystems and subsystem elements as part of a SRECS.
6.7.4.4.2
Replace the note of item c) by the following:
NOTE For electromechanical subsystems, the probability of failure should be estimated taking into account the
number of operating cycles declared by the manufacturer and the duty cycle (see 5.2.3). This information should be
based upon a B10 value (see IEC 61649) under the operating conditions stated by the manufacturer. See for
example IEC 60947-4-1, Annex K.
6.7.6.5
Delete this entire subclause and Table 6.
6.7.7.2
Delete the following text at item b):
(see references in Annex D)
Delete item c).
Existing item d) becomes item c).
Add the following new notes at the end of the subclause:
NOTE 1 Information of the failure mode ratios for electrical/electronic component can be found in several sources
including:
– MIL-HDBK 217F(Notice 2) Reliability Prediction of Electronic Equipment (28-02-95), Parts Stress Analysis
– MIL-HDBK 217F(Notice 2) Reliability Prediction of Electronic Equipment (28-02-95), Appendix A, Parts Count
Reliability Prediction
– SN 29500 Part 7, Failure Rates of Components, Expected Values for Relays, April 1992
– SN 29500 Part 11, Failure Rates of Components, Expected Values for Contactors, August 1990
– The documents in the SN 29500 series are publicly available and can be obtained from:
• Siemens AG, CT SR SI
Otto-Hahn-Ring 6
D-81739 München:
– UTE C 80-810 RDF 2000: Reliability data handbook – A universal model for reliability prediction of electronic
components, PCBs and equipment
– Failure mode/mechanism distributions FMD-91, RAC 1991.
NOTE 2 It is recommended to use failure rate data and failure mode ratio data provided by manufacturers.
NOTE 3 Some component standards have relevant data (e.g. Annex K of IEC 60947-4-1).
NOTE 4 Where a detailed analysis of each failure mode is not practically possible, a division of failures into 50 %
safe, 50 % dangerous is generally accepted.
NOTE 5 Lists of faults to be considered for mechanical, pneumatic, hydraulic and electrical technologies are
given in Annexes A, B, C and D of ISO 13849-2.
...