Crane Remote Control Safety Standards: PL-d and SIL 2 Explained
In crane operations, the communication link between operator and machine is the most safety-critical element in the entire system. Wireless crane remote controls introduce specific failure modes — signal interruption, hardware fault, battery failure — that must be managed by the control system itself, not left to operator reaction. This is where functional safety standards PL-d (ISO 13849-1) and SIL 2 (IEC 62061) become essential: they define the engineering requirements that force a crane into a safe stopped state when any failure occurs, before the operator can even respond. This article explains what these standards mean technically, why they are mandatory for crane applications, what the legal obligations are for facility operators, and which crane remote control brands meet these requirements.
Get in Touch for All Your Requirements
Functional Safety in Crane Remote Controls: What PL and SIL Actually Measure
Functional safety is the ability of a system to correctly and reliably execute its assigned safety function under all operating conditions. For crane remote controls, this means one specific guarantee: when the operator presses the emergency stop button, or when the communication link between transmitter and receiver is lost for any reason, all crane motion stops — without exception, without delay, and regardless of what the system was doing at that moment. Two international standards provide the framework for measuring and certifying this guarantee.
Performance Level (PL) — ISO 13849-1
ISO 13849-1 is the primary reference standard for evaluating the safety-related parts of machine control systems. It rates a system’s risk reduction capability on a five-level scale from PL a (lowest) to PL e (highest). For crane remote control applications, PL-d is the industry target — the minimum level required for high-risk operations. PL rating is not determined by hardware alone: software reliability and system architecture both contribute to the final level. Three parameters interact in the PL calculation:
- Category (Architecture): Describes the hardware structure of the system. In a Category 3 architecture, a single component failure does not cause loss of the safety function — the failure is detected and the system remains safe.
- MTTFd (Mean Time to Dangerous Failure): The average time before a dangerous failure occurs, classified as low, medium, or high. PL-d requires a high MTTFd rating.
- DC (Diagnostic Coverage): The percentage of dangerous failures that the system detects internally. PL-d requires medium to high DC — the system must actively monitor its own components for faults.
Safety Integrity Level (SIL) — IEC 62061
SIL is derived from IEC 62061 and its parent standard IEC 61508, and applies specifically to electrical, electronic, and programmable electronic (E/E/PE) safety systems. SIL levels run from 1 to 4; SIL 4 is rarely encountered in general machinery — SIL 3 is typically the highest requirement in industrial crane applications, with SIL 2 as the standard target. SIL level is determined by calculating the system’s Probability of Dangerous Failure per Hour (PFHd). A SIL 2 system has a PFHd between 10⁻⁷ and 10⁻⁶ — statistically, an extremely low probability of dangerous failure. This mathematical approach is the key evidence tool for demonstrating the reliability of modern programmable crane remote control electronics.
| Parameter | PL — ISO 13849-1 | SIL — IEC 62061 |
|---|---|---|
| Measurement Unit | Letter levels (a, b, c, d, e) | Numeric levels (1, 2, 3, 4) |
| Primary Focus | Hardware category, MTTFd, DC | Failure probability (PFHd), HFT, SFF |
| Application Scope | Mechanical, hydraulic, electrical systems | E/E/PE (electronic/software) systems |
| Crane Target Level | Minimum PL-d | Minimum SIL 2 |
Performance Level (PL – ISO 13849-1) Standartları
ISO 13849-1 standardı, makine kontrol sistemlerinin emniyetle ilgili kısımlarını değerlendirmek için kullanılan temel referanstır. Bu standart, bir sistemin risk azaltma yeteneğini Performance Level (PL) olarak adlandırılan “a”dan “e”ye kadar beş farklı seviyede derecelendirir. Vinç kumandası PL-d seviyesi, yüksek riskli operasyonlar için hedeflenen altın standarttır. PL seviyesinin belirlenmesinde sadece donanım değil, aynı zamanda yazılımın güvenilirliği ve sistemin mimari yapısı da rol oynar.
PL hesaplaması yapılırken şu üç temel parametre arasındaki etkileşim analiz edilir:
- Kategori (Mimari): Sistemin donanım yapısını ifade eder. Örneğin, Kategori 3 bir sistemde, tek bir hata emniyet fonksiyonunun kaybına yol açmaz ve bu hata sistem tarafından fark edilir.
- MTTFd (Mean Time to Dangerous Failure): Tehlikeli bir arızanın meydana gelmesine kadar geçen ortalama süredir. Bu süre “düşük”, “orta” ve “yüksek” olarak sınıflandırılır.
- DC (Diagnostic Coverage): Sistemin kendi içinde oluşabilecek hataları ne kadar etkili bir şekilde tespit edebildiğinin yüzdesel karşılığıdır.
Why PL-d and SIL 2 Are Mandatory for Crane Remote Controls
Overhead cranes, gantry cranes, and tower cranes are classified as Type-C product standard machinery — high-risk equipment where a control system failure can cause not just load drops, but structural collapse and fatalities. This classification drives the requirement for the highest safety levels in the control architecture. The risk assessment framework under ISO 13849-1 uses three parameters to determine the required performance level (PLr):
- S — Severity: Crane incidents typically carry S2 classification — risk of fatal injury or permanent disability.
- F — Frequency: Crane operators are exposed to the hazard continuously throughout their working shift — F2 classification.
- P — Possibility of Avoidance: When a heavy load swings or drops, the operator’s ability to escape is severely limited — P2 classification.
S2 + F2 + P2 combined yields a required performance level of PLr = d under ISO 13849-1. Any crane remote control system that does not achieve this level is technically insufficient and safety-deficient for the application.
The Engineering Depth Behind a PL-d Emergency Stop
A standard button press cuts a single electrical circuit. A PL-d emergency stop system guarantees that circuit interruption occurs under all conditions — including component failure. In a PL-d certified remote control unit, pressing the stop button activates a redundant architecture: two independent safety relays inside the receiver unit simultaneously cut power. Microprocessors perform cross-monitoring of both relay states — if one relay is stuck closed or a circuit has shorted, the system blocks the next operational cycle entirely until the fault is cleared.
Legal Obligations and Regulatory Exposure
The requirement for PL-d / SIL 2 compliant crane remote controls is not only a technical norm — it carries direct legal weight in most industrial jurisdictions. Non-compliant equipment exposes the facility operator to regulatory, civil, and in some cases criminal liability. In the event of an incident, the compliance status of the crane remote control is typically the first piece of evidence examined by safety inspectors to determine whether the accident was preventable.
European and International Regulatory Framework
Under the EU Machinery Directive 2006/42/EC, crane control devices must be designed and positioned so that unintended movement cannot create hazard. Where the nature of the hazard and the stopping time require it, the machinery must be equipped with an emergency stop function meeting the relevant EN standards. CE marking on a crane remote control certifies compliance with this directive — but CE alone does not certify PL-d or SIL 2. The safety certification documentation (Declaration of Conformity referencing ISO 13849-1 or IEC 62061) must be requested separately from the supplier.
Administrative Penalties for Non-Compliance
Beyond incident liability, routine safety inspections in most jurisdictions apply administrative fines for equipment that does not meet applicable standards. The financial exposure from a single inspection finding on crane control equipment — before any incident occurs — typically exceeds the cost of upgrading to a compliant system by a significant margin. Non-compliance is not a cost saving; it is a deferred liability.
Crane Remote Control Brands That Meet PL-d and SIL 2 Requirements
The reliability of a crane remote control is measured by the quality of its internal electronic components and the certifications its manufacturer has obtained — not by the durability of its outer casing. Brands that meet PL-d and SIL 2 standards have made significant R&D investment in redundant safety architecture, software validation, and independent testing. All brands supplied and serviced by Vinç Kumanda Servisi meet these requirements.
Elfatek
Elfatek crane remote systems operate on the 2.4 GHz ISM band with 80-channel capacity, eliminating signal congestion in dense industrial environments. The Security Key feature ensures only authorised personnel can activate the crane. All electronic, software, and mechanical components are manufactured in-house at Elfatek’s registered R&D centre in Konya — short spare part lead times are a direct result of this vertical integration. See the full Elfatek crane remote range.
Wieltra
Wieltra’s EVO612 OHS Mode implements a sequential motion interlock at software level — if the operator simultaneously presses “hoist” and “travel”, the system locks the second command until the first is complete. This directly addresses the pendulum effect, which is responsible for a significant proportion of crane-related injuries on production floors. For facilities where OHS compliance is a primary specification criterion, the EVO612 provides a software-level safety layer that goes beyond hardware certification alone. See Wieltra crane remote models.
Aykos, Mikotek, Henjel and Remobat
Aykos digital display models report charge status, signal quality, and fault codes in real time to the operator — proactive fault visibility that supports PL-d diagnostic coverage requirements. IP67-rated receivers extend service life in demanding installation conditions. Mikotek Ardıç, Çınar and Selvi series feature automatic fault diagnosis and remote monitoring compatibility, aligning with modern production automation requirements. Henjel GFSK modulation with PLL frequency stabilisation maintains signal integrity in high-EMI environments — a direct contribution to heartbeat reliability under interference. Remobat operates across extreme temperature ranges (documented to -35°C / +80°C), making it the correct specification for foundry and cold storage applications where standard units fall outside their rated range.
Retrofit and Control System Modernisation
A crane with sound mechanical structure but an outdated control system is not a safe crane. Expired safety certifications, legacy relay architectures that do not meet current PL/SIL requirements, and absent heartbeat monitoring all represent genuine operational risk regardless of the crane’s physical condition. Retrofit — the replacement of the control system while retaining the crane structure — is the correct engineering response to this situation.
A PL-d compliant control system upgrade delivers three measurable outcomes: legacy relays are replaced by certified safety processors with redundant circuits; the operator gains freedom to position away from the load path with wireless control up to 100 metres; and digital fault reporting replaces ambiguous mechanical indicator lights, reducing diagnostic time significantly. At Vinç Kumanda Servisi, retrofit installations include a full review of the crane’s electrical infrastructure — contactor condition in the control panel, safety circuit integrity, and overall PL/SIL compliance testing of the completed system. See our crane remote control installation service.
Conclusion
PL-d and SIL 2 are not marketing labels — they are engineering specifications with mathematical definitions, independent testing requirements, and direct legal consequences when they are absent. For crane remote control systems, these standards define the minimum acceptable safety architecture: redundant emergency stop relays, continuous heartbeat monitoring, cross-fault detection, and documented failure probability. A crane remote control that does not meet these levels is not simply a lower-cost alternative — it is a system that cannot guarantee safe crane arrest under all failure conditions. For procurement teams and facility engineers alike, verifying PL-d / SIL 2 compliance before purchase is not optional due diligence — it is the baseline requirement.
Frequently Asked Questions
What does PL-d certification mean for a crane remote control?
PL-d (Performance Level d) under ISO 13849-1 defines the capability of a safety-related control system to perform its safety function under high-risk conditions. For crane remote controls, it certifies that the emergency stop and signal loss response mechanisms will operate reliably — including under component failure conditions — through redundant relay architecture and microprocessor cross-monitoring.
What is the difference between SIL 2 and PL-d?
Both are functional safety standards, but from different standard families. PL-d (ISO 13849-1) focuses on system hardware architecture, MTTFd, and diagnostic coverage — primarily for mechanical and electromechanical systems. SIL 2 (IEC 62061) defines the same safety level through a mathematical probability of dangerous failure per hour (PFHd between 10⁻⁷ and 10⁻⁶), focused specifically on electronic and programmable systems. In modern crane remote controls, a system that meets PL-d will typically also meet SIL 2 — they represent equivalent safety levels through different assessment methodologies.
Is PL-d / SIL 2 a legal requirement for crane remote controls?
Yes. Under the EU Machinery Directive 2006/42/EC and national OHS legislation in most jurisdictions, high-risk machinery such as cranes must incorporate fail-safe control systems capable of stopping all motion safely under any failure condition. In post-incident inspections, the absence of PL-d / SIL 2 certification on the crane remote control is typically classified as a preventable deficiency that establishes employer liability.
If the wireless crane remote loses signal, does the crane keep moving?
No — on a PL-d and SIL 2 compliant system. The heartbeat (continuous handshake) between transmitter and receiver is monitored in real time. If the signal is lost for any reason — interference, obstacle, battery depletion — the system detects the absence within milliseconds and automatically triggers Emergency Stop mode, arresting all crane motion. Non-compliant systems may continue executing the last received command under signal loss, which is a direct safety hazard.
What is the difference between a standard emergency stop button and a PL-d E-Stop?
A standard button cuts a single electrical circuit — if the button mechanism fails or the circuit shorts, the crane may not stop. A PL-d emergency stop operates through two independent safety relays in the receiver, monitored by microprocessor cross-checking. If one relay is stuck or one circuit fails, the redundant relay still stops the crane, and the fault is detected to prevent the next operational cycle. This redundant architecture is the engineering substance behind the PL-d certification.
Can an existing crane remote control be upgraded to PL-d standard?
Yes — through a retrofit process. The existing control system is removed and replaced with a PL-d / SIL 2 certified remote control system and control panel, while the crane’s mechanical structure remains in service. Vinç Kumanda Servisi provides full retrofit installations including panel contactor inspection, safety circuit rewiring, and compliance testing of the complete installed system.
What are the risks of using non-certified crane remote controls?
Non-certified units lack redundant safety relays and signal validation software. Under a fault condition, the crane may continue executing the last command — hoisting or travelling — without operator intervention being effective. Beyond the direct safety risk, using non-certified equipment in a jurisdiction that mandates compliance exposes the employer to regulatory fines, civil liability in the event of an incident, and in serious cases, criminal prosecution of responsible individuals.
What do safety inspectors check on a crane remote control?
Inspectors typically examine: CE Declaration of Conformity; ISO 13849-1 (PL) or IEC 62061 (SIL) safety assessment documentation; physical evidence of redundant relay architecture in the receiver unit; emergency stop button condition and response time; and where applicable, software safety features such as motion interlock (OHS mode). The absence of any of these creates an inspection finding regardless of the crane’s mechanical condition.
Which crane remote control brands meet PL-d and SIL 2 standards?
All brands supplied by Vinç Kumanda Servisi — Elfatek, Wieltra, Aykos, Mikotek, Henjel, and Remobat — are manufactured to meet PL-d and SIL 2 requirements. Request the ISO 13849-1 safety assessment documentation for the specific model you are evaluating to confirm the certified performance level.
What does OHS Mode mean in a crane remote control?
OHS (Occupational Health and Safety) Mode — as implemented in the Wieltra EVO612 — is a software layer that prevents simultaneous conflicting motion commands. If the operator presses both “hoist” and “travel” at the same time, the system locks the second command until the first motion is complete. This eliminates the pendulum effect caused by simultaneous multi-axis crane movement, which is a leading cause of load swing incidents in production environments.
Is a second-hand crane remote control safe to use?
Electronic fatigue in relays, microprocessor drift, and safety software version obsolescence are not visible during physical inspection of a second-hand unit. A device without current certification documentation or independent service history cannot be verified to meet PL-d / SIL 2 requirements. For safety-critical crane control applications, new certified units are the correct specification — the cost differential does not justify the liability exposure of an unverifiable safety system.
What does MTTFd mean in practice for a crane operator?
MTTFd (Mean Time to Dangerous Failure) is the average operational time before a component creates a dangerous failure condition. In PL-d systems, MTTFd is rated as “high” — meaning the probability of a dangerous failure within the expected service life of the component is statistically minimised. In practical terms, a high MTTFd rating means the crane remote control system is engineered to remain safe over its entire operational lifespan, not just during initial deployment.
If the crane remote housing is damaged by water or impact, how does the safety system respond?
IP65 or IP67 rated enclosures resist water and dust ingress during normal operation. If the housing is physically damaged — cracked casing allowing moisture ingress or circuit board short circuits from impact — the Diagnostic Coverage (DC) system within the PL-d architecture detects the fault and blocks the damaged transmitter from sending commands to the crane receiver. The system fails safe: it stops the crane rather than allowing continued operation under a fault condition.
When should a faulty crane remote be repaired versus replaced?
Button replacement, keypad repairs, and outer casing replacement can be performed by an authorised service centre without compromising certification. Structural faults in the main control board, microprocessor, or emergency stop safety relays are a different matter — replacing these components without factory certification of the repaired unit risks invalidating the PL-d / SIL 2 compliance of the system. In these cases, Vinç Kumanda Servisi recommends replacing the affected module or complete unit with a certified original replacement rather than attempting board-level repair.
Contact Vinç Kumanda Servisi
Need to verify whether your current crane remote controls meet PL-d / SIL 2 requirements, or looking to upgrade an existing system through a certified retrofit? Contact Vinç Kumanda Servisi via WhatsApp at +90 532 546 84 62, email us at info@vinckumandaservisi.com, or visit our contact page for a technical assessment and tailored quote.