{"id":51691,"date":"2026-03-13T10:45:43","date_gmt":"2026-03-13T09:45:43","guid":{"rendered":"https:\/\/www.gt-engineering.it\/?post_type=pubblicazione&p=51691"},"modified":"2026-03-30T08:27:53","modified_gmt":"2026-03-30T07:27:53","slug":"pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2","status":"publish","type":"pubblicazione","link":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/","title":{"rendered":"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2"},"content":{"rendered":"\n\n \n \n \n
\n\n \n
\n \n
\n \n \n

\n Summary <\/h2>\n <\/div>\n <\/div>\n \n \n
\n \n
\n

This article is part of a series of articles written on Functional Safety of Machinery. We recently introduced one of the two standards used to design Safety Control Systems in High Demand: ISO 13849-1. We are now presenting the key aspects of IEC 62061. In the previous edition of TUTTOMISURE we presented Architecture A and B; we will now detail Architecture C:<\/strong> the equivalent of Category 2 of ISO 13849-1, in other terms a single cannel with diagnostics.<\/p>\n<\/div> <\/div>\n \n \n

<\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
\n\n \n
\n \n
\n \n \n

\n Basic Subsystem Architecture C: 1oo1D <\/h2>\n <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
\n \n
\n

In this Architecture, single channel with diagnostic, any undetected dangerous fault of the subsystem element leads to a dangerous failure of the safety function. Where a fault of a subsystem element is detected, the diagnostic function initiates a fault reaction<\/strong>. This Architecture corresponds to a Hardware Fault Tolerance of 0.<\/p>\n<\/div> <\/div>\n \n \n

<\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
\n\n \n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
\n \n
\n

This Architecture corresponds to the Category 2 of ISO 13849-1; in figure 2 there is a more precise representation.<\/p>\n

You can notice that the TE (Test Equipment) of Category 2 in ISO 13849-1 is defined as Fault Diagnostic Function<\/strong> in IEC 62061. Likewise, the equivalent of the OTE is the Fault Reaction Function<\/strong>. The TE + OTE is defined as the Fault Handling Function<\/strong> in IEC 62061.<\/p>\n<\/div> <\/div>\n \n \n

<\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
\n\n \n
\n \n
\n \n \n

\n Conditions for a correct implementation of Basic Subsystem Architecture C <\/h2>\n <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
\n \n
\n

For Architecture C, the calculation of PFH assumes a time-optimal fault handling. Time optimal<\/strong> fault handling of a subsystem element can be assumed if one of the following conditions<\/strong> are satisfied:<\/p>\n

    \n
  • The diagnostic rate is at least a factor of 100 higher than the demand rate<\/strong> of the safety function and the time needed for the fault reaction is sufficiently short to bring the system to a safe state, before a hazardous event occurs; or <\/strong><\/li>\n
  • The fault handling is performed immediately upon any potential demand<\/strong> of the safety function and the time needed<\/strong> to detect a detectable fault and to bring the system to a safe state is shorter than the process safety time; or <\/strong><\/li>\n
  • The fault handling is performed continuously, and the time needed to detect a detectable fault and to bring the system to a safe state is shorter than the process safety time; or<\/strong><\/li>\n
  • The fault handling is performed periodically and the sum of the test interval, the time needed to detect a detectable fault and time needed to bring the system to a safe state is shorter than the process safety time.<\/li>\n<\/ul>\n

    The table 1 summarises all possible conditions related to a correct implementation of a 1oo1D architecture.<\/p>\n

      \n
    • Situation 1 and 3. <\/strong>If no safe state is possible, regardless of the case if there is an optimal testing frequency or not, we cannot claim 1oo1D Architecture. Therefore, we fall back to a 1oo1<\/strong> Architecture, where well-tried components must be used.<\/li>\n<\/ul>\n

      The reason for the difference with ISO 13849-1, in case of Situation 3, is due to the link of IEC 62061 to IEC 61508.<\/p>\n

      [IEC 61508-2] 7.4.8 Requirements for system behaviour on detection of a fault <\/em><\/strong><\/p>\n

      7.4.8.3<\/em><\/strong> The detection of a dangerous fault (by diagnostic tests, proof tests or by any other means) in any subsystem having a hardware fault tolerance of 0 shall, in the case of a subsystem that is implementing any safety function(s) operating in the high demand or the continuous mode, result in a specified action to achieve or maintain a safe state<\/strong> (see Note).\u00a0 <\/em><\/p>\n

      NOTE:<\/em><\/strong> The specified action required to achieve or maintain a safe state will be specified in the E\/E\/PE system safety requirements (see IEC 61508-1, 7.10). It may consist, for example, of the safe shut-down of the EUC, or that part of the EUC that relies, for functional safety, on the faulty subsystem.\u00a0 <\/em><\/p><\/blockquote>\n

        \n
      • Situation 2.<\/strong> No Optimal testing is present; however, in case a fault is detected, we can bring the system to a safe state. We can claim a 1oo1D<\/strong> Basic Subsystem Architecture and we can reach SIL 2, if all other conditions exist. No need to use well-tried components.<\/li>\n
      • Situation 4.<\/strong> We have both optimal testing and, in case a fault is detected, we can bring the system to a safe state. We can claim a 1oo1D<\/strong> Basic Subsystem Architecture and we can reach SIL 2, if all other conditions exist. No need to use well-tried components.<\/li>\n<\/ul>\n

        This is a \u201cdelicate\u201d Architecture, similarly to the Category 2. The issue is the failure of the Diagnostic Function, called Fault handling Function, while the Functional Channel is still working. The Fault Handling function<\/strong> includes both the Fault Diagnostics<\/strong> function and the Fault Reaction<\/strong> function.<\/p>\n<\/div> <\/div>\n \n \n

        <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
        \n\n \n\n
        \n \n \n
        \n \n \n

        \n Basic Subsystem Architecture C with Fault Handling done by the SCS <\/h2>\n <\/div>\n \n
        \n

        This one is the simplest situation, since the Diagnostic and Fault Reaction Functions<\/strong> (equivalent to TE and OTE in ISO 13849-1) are already part of the safety function. The fault handling function is completely performed by a separate subsystem of the SCS,<\/strong> which is also involved in performing the safety function, thus contributing to its PFH.<\/p>\n

        In other terms, in this case we can ignore the reliability of the Monitoring channel since that is already taken care while calculating the reliability of the Functional Channel.<\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

        \n\n \n\n
        \n \n \n
        \n

        This could be the case whereby a Safety-related Control System monitors if a motor contactor has opened and, in case of failure, it de-energises another contactor, that is part of another safety function.<\/p>\n

        If we consider a Subsystem C, made of n elements numbered from 1 to n, the PFH is given by the following formula:<\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

        \n\n \n \n \n
        \n \n
        \n

        As you can see, the reliability of the Fault Handling Function (or monitoring function) is not present in the formula. It is the same formula used in the first edition of the standard.<\/p>\n<\/div> <\/div>\n \n \n

        <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
        \n\n \n
        \n \n
        \n \n \n

        \n Basic Subsystem Architecture C with mixed Fault Handling <\/h2>\n <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
        \n \n
        \n

        These are all cases where the reliability of the monitoring channel, or better, the Fault Handling function, is outside of the Safety Function. In order to calculate the PFH of this architecture, a new failure rate has to be introduced: it is called the failure rate of the Fault Handling Function<\/strong>, or \u03bb<\/strong>D-FH<\/sub><\/strong>.<\/p>\n

        A Markov model was used to arrive to the different PFH formulas.<\/p>\n

        There are 3 possible situations:<\/p>\n

          \n
        1. The subsystem C has external Fault Diagnostics<\/strong> (TE), but the element performing the fault reaction (it would be the OTE in ISO 13849-1 Category 2) is internal to the subsystem.<\/li>\n<\/ol>\n

          In this case the fault handling failure rate includes the Fault Reaction<\/strong> function only.<\/p>\n

          That means \u03bb<\/strong>D-FH<\/sub><\/strong>= \u03bb<\/strong>D-FR<\/sub><\/strong><\/p>\n

          The Failure Rate of the Fault Diagnostic<\/strong> function is not considered, since it is already taken care while calculating the reliability of the Functional Channel.<\/p>\n<\/div> <\/div>\n \n \n

          <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
          \n\n \n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
          \n \n
          \n

          2. The Subsystem C has external Fault Reaction<\/strong> (OTE), while the Fault Diagnostic<\/strong> (TE) is done Internally to the subsystem.<\/p>\n

          In this case the fault handling failure rate includes the Fault Diagnostic<\/strong> function only.<\/p>\n

          That means \u03bb<\/strong>D-FH<\/sub><\/strong>= \u03bb<\/strong>D-FD<\/sub><\/strong><\/p>\n

          The Failure Rate of the Fault Reaction<\/strong> function is not considered since it is already taken care while calculating the reliability of the Functional Channel.<\/p>\n<\/div> <\/div>\n \n \n

          <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
          \n\n \n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
          \n \n
          \n

          3. The subsystem C has both Fault Diagnostics<\/strong> and Fault Reaction<\/strong> internal to the subsystem.<\/p>\n

          In this case the fault handling failure rate includes both the diagnostic function and the fault reaction function.<\/p>\n

          That means \u03bb<\/strong>D-FH <\/sub><\/strong>= \u03bb<\/strong>D-FD <\/sub><\/strong>+ \u03bb<\/strong>D-FR<\/sub><\/strong><\/p>\n<\/div> <\/div>\n \n \n

          <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
          \n\n \n\n
          \n \n \n
          \n \n \n

          \n PFH in case of four conditions satisfied <\/h2>\n <\/div>\n \n
          \n

          In all of the 3 cases previously described, there is a simple equation that can be used to calculate the PFH value, provided all the following conditions are satisfied<\/strong>:<\/p>\n

            \n
          1. \u03b2 \u2264 2 %;<\/li>\n
          2. DC \u2264 99 %;<\/li>\n
          3. 1\/\u03bbDe\u00a0 <\/sub>\u2264 1.000 years;<\/li>\n
          4. 1\/ \u03bbD-FH <\/sub>has at least the minimum value according to Table 7.9 {7.2.4.1};<\/li>\n<\/ol>\n

            where \u03bbD-FH<\/sub> is the failure rate of the single element that realizes the fault handling function within the subsystem.<\/p>\n

            The equation is the following:<\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

            \n\n \n\n
            \n \n \n
            \n

            If the functional channel has more than one element, the related DC is calculated using the following formula.<\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

            \n\n \n
            \n \n
            \n \n \n

            \n PFH in case one of the four conditions is not satisfied <\/h2>\n <\/div>\n <\/div>\n \n \n
            \n \n
            \n

            In case one of the above four conditions<\/strong> is not satisfied, the simplified formula cannot be used, since it may give a lower value of PFH and therefore provide a higher reliability than the reality.<\/p>\n

            If the functional channel is comprised by one element only and the fault handling function, within the subsystem, is realized by another single element, the following equation can be used:<\/p>\n<\/div> <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

            \n\n \n \n \n
            \n \n
            \n

            Where:<\/p>\n

              \n
            • T1<\/sub><\/strong> is the Proof Test interval of the perfect Proof Test or useful lifetime whichever is the smaller;<\/li>\n
            • \ud835\udf06<\/strong>De<\/sub><\/strong> is the dangerous failure rate of the single element of the functional channel;<\/li>\n
            • \ud835\udf06<\/strong>D-FH<\/sub><\/strong> is the failure rate of the single element that realizes the fault handling function(s) within the subsystem;<\/li>\n
            • DC<\/strong> is the diagnostic coverage for the single element e of the functional channel;<\/li>\n
            • \u03b2<\/strong> is the susceptibility to common cause failures of the functional channel and the channel that realizes the fault handling function(s) within the subsystem.<\/li>\n<\/ul>\n

              The same equation can be used even in case all the 4 above conditions are satisfied: it is the general formula for Architecture C: it is always valid<\/strong>.<\/p>\n

              You may notice that, in case the dangerous failure rate(s) of the fault handling function(s) within the subsystem can be assumed to be zero (\ud835\udf06D-FH<\/sub> = 0), the equation becomes the same as the one in \u00a7 7.2.6.1. The reason is obvious: the monitoring channel is assumed to have a very high reliability.<\/p>\n

              Please consider that the general formula can be used even if the reliability of the fault handling function is worse than that required by Table 2.<\/strong><\/p>\n<\/div> <\/div>\n \n \n

              <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
              \n\n \n
              \n \n
              \n \n \n

              \n Implications of the Architectural Constraints in Basic Subsystem Architecture C <\/h2>\n <\/div>\n <\/div>\n \n \n
              \n \n
              \n

              Architecture C subsystems have an HFT = 0. That means, based upon the SFF, a maximum of SIL 3 can be achieved. However, it is important to verify that one of the following conditions is satisfied:<\/p>\n

                \n
              • the sum of the diagnostic test interval and the time to perform the specified fault reaction<\/strong> function to achieve or maintain a safe state shall be shorter than the process safety time (e.g. see ISO 13855);<\/li>\n
              • Or, the ratio of the diagnostic test rate to the demand rate shall be equal to or greater than 100. <\/strong>This last condition aligns Architecture 1oo1D with Category 2.<\/li>\n<\/ul>\n

                Therefore, a monitored single channel subsystem (1oo1D), where none of the two conditions are met, has to be considered a Basic Subsystem Architecture A (1oo1); please refer to Table 7.8.<\/p>\n

                Table 3 is applicable. Normally SFF < 99%, since SFF \u2265 99 % is only possible when there is continuous monitoring of the correct functioning of the element: typically, only electronic technology can have this.<\/p>\n<\/div> <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

                \n\n \n
                \n \n
                \n \n \n

                \n Example of a Basic Subsystem Architecture C <\/h2>\n <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
                \n \n
                \n

                Let\u2019s consider the output subsystem as shown in Figure 7. KP<\/sub> has B10<\/sub> = 106<\/sup> with 73% as percentage of dangerous failures. U< is has a B10<\/sub> = 4\u00b7105<\/sup>. The Mission Time of both the contactor and the undervoltage coil is 20 years.<\/p>\n

                KP<\/sub> is supposed to open twice per minute<\/strong> while U< is supposed to open once per month<\/strong>.<\/p>\n

                Let\u2019s now focus on the calculation of probability of random failures<\/strong>.<\/p>\n

                  \n
                1. The first step<\/strong> is to calculate the \ud835\udf06<\/strong>D<\/sub><\/strong> of the contactor KP<\/sub>. We assume the machine is working 240 days per year and eight hours per day.<\/li>\n<\/ol>\n<\/div> <\/div>\n \n \n
                  <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
                  \n\n \n\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
                  \n\n \n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n
                  \n \n
                  \n

                  2. The second step<\/strong> is to calculate T1 <\/sub>and \u03b2.<\/p>\n

                  T1<\/sub>=min (Useful Life; Proof Test);<\/p>\n

                  Useful Life= min (Mission Time; T10D<\/sub>);<\/p>\n

                  Mission Time = 20 years;<\/p>\n

                   <\/p>\n<\/div> <\/div>\n \n \n

                  <\/div>\n \n\n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n
                  \n\n \n\n
                  \n \n \n
                  \n

                  Useful Life = min (20 years; 5,9 years) \u00e0 Useful Life = 5,9 years;<\/p>\n

                  Proof Test > 20 years<\/p>\n

                  T1<\/sub> = min (5,9 years ; > 20 years) \u00e0T1 <\/sub>= 5,9 years = 52 560 hours<\/strong>;<\/p>\n

                  Based upon the CCF criteria listed in Annex E of the standard, we can assume a \u03b2 = 0,02.<\/p>\n

                   <\/p>\n

                   <\/p>\n

                  3. The third step<\/strong> is the determination of the Diagnostic Coverage<\/strong>. Being a single channel with a testing element, which directly monitors the status of KP<\/sub>, we assume DC = SFF = 90%.<\/p>\n

                  Now, we have to check that the \ud835\udf06<\/strong>D-FH<\/sub><\/strong> value of the test channel is not lower than specified in Table 2.<\/strong> In this case, functional channel and testing channel have the Safety PLC in common, in other terms, we are in the situation of figure 4: External Fault Diagnostic. <\/strong>The Fault Reaction (the undervoltage coil) is considered part of the output subsystem while the Fault Handling is not, since its reliability is already taken care in the reliability calculation of the Functional Channel, that include the Safety Logic. For that reason, only the failure rate of the undervoltage coil is important for the \ud835\udf06<\/strong>D-FH<\/sub><\/strong>.<\/p>\n

                  U< is used only when a fault is detected, once per month:<\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

                  \n\n \n\n
                  \n \n \n
                  \n

                  Since we claim a DC of 90%, based upon table 2, the minimum value of 1\/\ud835\udf06<\/strong>D-FH\u00a0 <\/sub>is 1200.<\/p>\n

                  In this case 1\/\ud835\udf06DU<<\/sub>\u00a0is much higher than required in the table 2: the condition is fulfilled;<\/p>\n

                   <\/p>\n

                  4. The fourth step<\/strong> is the determination of the Diagnostic Coverage<\/strong>. Being a single channel with a testing element, which directly monitors the status of KP<\/sub>, we assume DC = SFF = 90%.<\/p>\n

                  5. The last step<\/strong> is to calculate PFH<\/p>\n

                  All the following conditions are satisfied:<\/p>\n

                    \n
                  • \u03b2 \u2264 2 %;<\/li>\n
                  • DC \u2264 99 %;<\/li>\n
                  • 1\/ \ud835\udf06\ud835\udc37\ud835\udc52<\/sub> =1\/ \ud835\udf06\ud835\udc37<\/sub>KP<\/sub> = 1\/1,92 x 10-6 8760\u00a0 = 59,5 < 1.000 years;<\/li>\n
                  • 1\/ \ud835\udf06D-FH<\/sub> =1\/ \ud835\udf06DFR<\/sub> =1\/ \ud835\udf06DU<<\/sub> = 333 333 > 1200 years;<\/li>\n<\/ul>\n

                    Therefore the simplified equation can be used.<\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n\n\n\n\n \n \n \n

                    \n\n \n\n
                    \n \n \n
                    \n

                    With a SFF = 90 % and HFT = 0, the SIL level is limited by the Architectural Constraints to SIL 2.<\/p>\n

                    The Safety Subsystem reaches SIL 2<\/strong> and has a PFH = 1,92 <\/strong>10-7<\/sup><\/strong><\/p>\n<\/div> <\/div>\n <\/div>\n \n \n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n <\/picture>\r\n\r\n \r\n\r\n \r\n \r\n <\/div>\n \n <\/div>\n <\/section>\n\n \n","protected":false},"excerpt":{"rendered":"

                    This article is part of a series of articles written on Functional Safety of Machinery<\/p>\n","protected":false},"author":2,"featured_media":51719,"parent":49606,"menu_order":13,"template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-51691","pubblicazione","type-pubblicazione","status-publish","has-post-thumbnail","hentry"],"acf":[],"yoast_head":"\nP14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2 - Gt-Engineering<\/title>\n<meta name=\"description\" content=\"This article is part of a series on functional safety of machinery; the aim is to present the key aspects of IEC 62061.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2 - Gt-Engineering\" \/>\n<meta property=\"og:description\" content=\"This article is part of a series on functional safety of machinery; the aim is to present the key aspects of IEC 62061.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/\" \/>\n<meta property=\"og:site_name\" content=\"Gt-Engineering\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-30T07:27:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png\" \/>\n\t<meta property=\"og:image:width\" content=\"969\" \/>\n\t<meta property=\"og:image:height\" content=\"582\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/\",\"url\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/\",\"name\":\"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2 - Gt-Engineering\",\"isPartOf\":{\"@id\":\"https:\/\/www.gt-engineering.it\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png\",\"datePublished\":\"2026-03-13T09:45:43+00:00\",\"dateModified\":\"2026-03-30T07:27:53+00:00\",\"description\":\"This article is part of a series on functional safety of machinery; the aim is to present the key aspects of IEC 62061.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#primaryimage\",\"url\":\"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png\",\"contentUrl\":\"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png\",\"width\":969,\"height\":582},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.gt-engineering.it\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Pubblications\",\"item\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"In-depth articles tuttomisure\",\"item\":\"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.gt-engineering.it\/en\/#website\",\"url\":\"https:\/\/www.gt-engineering.it\/en\/\",\"name\":\"Gt-Engineering\",\"description\":\"bizonweb\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.gt-engineering.it\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2 - Gt-Engineering","description":"This article is part of a series on functional safety of machinery; the aim is to present the key aspects of IEC 62061.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/","og_locale":"en_US","og_type":"article","og_title":"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2 - Gt-Engineering","og_description":"This article is part of a series on functional safety of machinery; the aim is to present the key aspects of IEC 62061.","og_url":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/","og_site_name":"Gt-Engineering","article_modified_time":"2026-03-30T07:27:53+00:00","og_image":[{"width":969,"height":582,"url":"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/","url":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/","name":"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2 - Gt-Engineering","isPartOf":{"@id":"https:\/\/www.gt-engineering.it\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#primaryimage"},"image":{"@id":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png","datePublished":"2026-03-13T09:45:43+00:00","dateModified":"2026-03-30T07:27:53+00:00","description":"This article is part of a series on functional safety of machinery; the aim is to present the key aspects of IEC 62061.","breadcrumb":{"@id":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#primaryimage","url":"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png","contentUrl":"https:\/\/www.gt-engineering.it\/wp-content\/uploads\/2026\/03\/copertina-3.png","width":969,"height":582},{"@type":"BreadcrumbList","@id":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/pt-14-functional-safety-in-high-demand-iec-62061-and-architectures-part-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.gt-engineering.it\/en\/"},{"@type":"ListItem","position":2,"name":"Pubblications","item":"https:\/\/www.gt-engineering.it\/en\/pubblications\/"},{"@type":"ListItem","position":3,"name":"In-depth articles tuttomisure","item":"https:\/\/www.gt-engineering.it\/en\/pubblications\/in-depth-articles-tuttomisure\/"},{"@type":"ListItem","position":4,"name":"P14: Functional Safety in High Demand: IEC 62061 and Architectures, Part 2"}]},{"@type":"WebSite","@id":"https:\/\/www.gt-engineering.it\/en\/#website","url":"https:\/\/www.gt-engineering.it\/en\/","name":"Gt-Engineering","description":"bizonweb","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.gt-engineering.it\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/pubblicazione\/51691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/pubblicazione"}],"about":[{"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/types\/pubblicazione"}],"author":[{"embeddable":true,"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/users\/2"}],"version-history":[{"count":6,"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/pubblicazione\/51691\/revisions"}],"predecessor-version":[{"id":51805,"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/pubblicazione\/51691\/revisions\/51805"}],"up":[{"embeddable":true,"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/pubblicazione\/49606"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/media\/51719"}],"wp:attachment":[{"href":"https:\/\/www.gt-engineering.it\/en\/wp-json\/wp\/v2\/media?parent=51691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}