EN ISO 25119-3:2023

SLOVENSKI STANDARD
01-november-2023
Traktorji ter kmetijski in gozdarski stroji - Varnostni deli krmilnih sistemov - 3. del:
Razvoj serije, strojna in programska oprema (ISO 25119-3:2018)
Tractors and machinery for agriculture and forestry - Safety-related parts of control
systems - Part 3: Series development, hardware and software (ISO 25119-3:2018)
Traktoren und Maschinen für die Land- und Forstwirtschaft - Sicherheitsbezogene Teile
von Steuerungen - Teil 3: Serienentwicklung, Hardware und Software (ISO 25119-
3:2018)
Tracteurs et matériels agricoles et forestiers - Parties des systèmes de commande
relatives à la sécurité - Partie 3: Développement en série, matériels et logiciels (ISO
25119-3:2018)
Ta slovenski standard je istoveten z: EN ISO 25119-3:2023
ICS:
35.240.99 Uporabniške rešitve IT na IT applications in other fields
drugih področjih
65.060.01 Kmetijski stroji in oprema na Agricultural machines and
splošno equipment in general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EN ISO 25119-3
EUROPEAN STANDARD
NORME EUROPÉENNE
September 2023
EUROPÄISCHE NORM
ICS 35.240.99; 65.060.01
English Version
Tractors and machinery for agriculture and forestry -
Safety-related parts of control systems - Part 3: Series
development, hardware and software (ISO 25119-3:2018)
Tracteurs et matériels agricoles et forestiers - Parties Traktoren und Maschinen für die Land- und
des systèmes de commande relatives à la sécurité - Forstwirtschaft - Sicherheitsbezogene Teile von
Partie 3: Développement en série, matériels et logiciels Steuerungen - Teil 3: Serienentwicklung, Hardware
(ISO 25119-3:2018) und Software (ISO 25119-3:2018)
This European Standard was approved by CEN on 9 January 2023.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and
United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2023 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 25119-3:2023 E
worldwide for CEN national Members.

Contents Page
European foreword. 3
Annex ZA (informative) Relationship between this European Standard and the essential
requirements of Directive 2006/42/EC aimed to be covered . 4

European foreword
The text of ISO 25119-3:2018 has been prepared by Technical Committee ISO/TC 23 "Tractors and
machinery for agriculture and forestry” of the International Organization for Standardization (ISO)
and has been taken over as EN ISO 25119-3:2023 by Technical Committee CEN/TC 144 “Tractors and
machinery for agriculture and forestry” the secretariat of which is held by AFNOR.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by March 2024, and conflicting national standards shall
be withdrawn at the latest by March 2024.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document has been prepared under a Standardization Request given to CEN by the European
Commission and the European Free Trade Association, and supports essential requirements of EU
Directive(s) / Regulation(s).
For the relationship with EU Directive(s) / Regulation(s), see informative Annex ZA, which is an
integral part of this document.
Any feedback and questions on this document should be directed to the users’ national standards
body. A complete listing of these bodies can be found on the CEN website.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary,
Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal,
Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Türkiye and the United Kingdom.
Endorsement notice
The text of ISO 25119-3:2018 has been approved by CEN as EN ISO 25119-3:2023 without any
modification.
Annex ZA
(informative)
Relationship between this European Standard and the essential
requirements of Directive 2006/42/EC aimed to be covered
This European Standard has been prepared under a Commission’s standardization request “M/396
Mandate to CEN and CENELEC for Standardisation in the field of machinery" to provide one
voluntary means of conforming to essential requirements of Directive 2006/42/EC of the European
Parliament and of the Council of 17 May 2006 on machinery, and amending Directive 95/16/EC
(recast).
Once this standard is cited in the Official Journal of the European Union under that Directive,
compliance with the normative clauses of this standard given in Table ZA.1 confers, within the limits
of the scope of this standard, a presumption of conformity with the corresponding essential
requirements of that Directive, and associated EFTA regulations.
Table ZA.1— Correspondence between this European Standard and Annex I of Directive
2006/42/EC
The relevant Essential Clause(s)/sub-clause(s) of Remarks/Notes
Requirements of Directive this EN
2006/42/EC
1.1.2. Principles of safety -----

integration
1.1.2(a) 5, 6, 7, B5
1.1.2(c) 5, 6, 7, B5
1.1.2(d) NOT COVERED
1.1.2(e) NOT COVERED
1.1.3. Materials and products NOT COVERED
1.1.4. Lighting NOT COVERED
1.1.5. Design of machinery to
NOT COVERED
facilitate its handling
1.1.6. Ergonomics NOT COVERED
1.1.7. Operating positions NOT COVERED
1.1.8. Seating NOT COVERED
1.2. CONTROL SYSTEMS -----
1.2.1. Safety and reliability of 5, 6, 7, B5

control systems
1.2.2. Control devices NOT COVERED
1.2.3. Starting NOT COVERED
1.2.4. Stopping -----
1.2.4.1 Normal Stop NOT COVERED
1.2.4.2. Operational stop NOT COVERED
1.2.4.3. Emergency stop NOT COVERED
1.2.4.4. Assembly of machinery NOT COVERED
1.2.5. Selection of control or
NOT COVERED
operating modes
1.2.6. Failure of the power 5, 6, 7, B5

supply
1.3. PROTECTION AGAINST ----
MECHANICAL HAZARDS
1.3.1. Risk of loss of stability NOT COVERED
1.3.2. Risk of break-up during
NOT COVERED
operation
1.3.3. Risks due to falling or
NOT COVERED
ejected objects
1.3.4. Risks due to surfaces,
NOT COVERED
edges or angles
1.3.5. Risks related to combined
NOT COVERED
machinery
1.3.6. Risks related to variations
NOT COVERED
in operating conditions
1.3.7. Risks related to moving
NOT COVERED
parts
1.3.8. Choice of protection
against risks arising from NOT COVERED
moving parts
1.3.9. Risks of uncontrolled
NOT COVERED
movements
1.4. REQUIRED ----
CHARACTERISTICS OF GUARDS
AND PROTECTIVE DEVICES
1.4.1. General requirements NOT COVERED
1.4.2. Special requirements for
NOT COVERED
guards
1.4.3. Special requirements for
NOT COVERED
protective devices
1.5. RISKS DUE TO OTHER ----
HAZARDS
1.5.1. Electricity supply NOT COVERED
1.5.2. Static electricity NOT COVERED
1.5.3. Energy supply other than
NOT COVERED
electricity
1.5.4. Errors of fitting NOT COVERED
1.5.5. Extreme temperatures NOT COVERED
1.5.6. Fire NOT COVERED
1.5.7. Explosion NOT COVERED
1.5.8. Noise NOT COVERED
1.5.9. Vibrations NOT COVERED
1.5.10. Radiation NOT COVERED
1.5.11. External radiation NOT COVERED
1.5.12. Laser radiation NOT COVERED
1.5.13. Emissions of hazardous
NOT COVERED
materials and substances
1.5.14. Risk of being trapped in
NOT COVERED
a machine
1.5.15. Risk of slipping, tripping
NOT COVERED
or falling
1.5.16. Lightning NOT COVERED
1.6. MAINTENANCE -----
1.6.1. Machinery maintenance NOT COVERED
1.6.2. Access to operating
NOT COVERED
positions and servicing points
1.6.3. Isolation of energy
NOT COVERED
sources
1.6.4. Operator intervention NOT COVERED
1.6.5. Cleaning of internal parts NOT COVERED
1.7. INFORMATION ----
1.7.1. Information and warnings
NOT COVERED
on the machinery
1.7.1.1. Information and
NOT COVERED
information devices
1.7.1.2. Warning devices NOT COVERED
1.7.2. Warning of residual risks NOT COVERED
1.7.3. Marking of machinery NOT COVERED
1.7.4. Instructions NOT COVERED
2.4. MACHINERY FOR ----
PESTICIDE APPLICATION
2.4.2. General NOT COVERED
2.4.3. Controls and monitoring NOT COVERED
2.4.4. Filling and emptying NOT COVERED
2.4.5. Application of pesticides ----
2.4.5.1. Application rate NOT COVERED
2.4.5.2. Distribution, deposition
NOT COVERED
and drift of pesticide
2.4.5.3. Tests NOT COVERED
2.4.5.4. Losses during stoppage NOT COVERED
2.4.6. Maintenance ----
2.4.6.1. Cleaning NOT COVERED
2.4.6.2. Servicing NOT COVERED
2.4.7. Inspections NOT COVERED
2.4.8. Marking of nozzles,
NOT COVERED
strainers and filters
2.4.9. Indication of pesticide in
NOT COVERED
use
2.4.10. Instructions NOT COVERED
3.2. WORK POSITIONS ---
3.2.1. Driving position NOT COVERED
3.2.2. Seating NOT COVERED
3.2.3. Positions for other
NOT COVERED
persons
3.3. CONTROL SYSTEMS ---
3.3.1. Control devices NOT COVERED
3.3.2. Starting/moving NOT COVERED
3.3.3. Travelling function NOT COVERED
3.3.4. Movement of pedestrian-
NOT COVERED
controlled machinery
3.3.5. Control circuit failure NOT COVERED
3.4. PROTECTION AGAINST ---
MECHANICAL HAZARDS
3.4.1. Uncontrolled movements NOT COVERED
3.4.2. Moving transmission
NOT COVERED
parts
3.4.3. Roll-over and tip-over NOT COVERED
3.4.4. Falling objects NOT COVERED
3.4.5. Means of access NOT COVERED
3.4.6. Towing devices NOT COVERED
3.4.7. Transmission of power
between self-propelled
NOT COVERED
machinery (or tractor) and
recipient machinery
3.5. PROTECTION AGAINST ----
OTHER HAZARDS
3.5.1. Batteries NOT COVERED
3.5.2. Fire NOT COVERED
3.5.3. Emissions of hazardous
NOT COVERED
substances
3.6. INFORMATION AND ----
INDICATIONS
3.6.1. Signs, signals and
NOT COVERED
warnings
3.6.2. Marking NOT COVERED
3.6.3. Instructions ----
3.6.3.1. Vibrations NOT COVERED
3.6.3.2. Multiple uses NOT COVERED

Table ZA.2 — Applicable Standards to confer presumption of conformity as described in this
Annex ZA
Column 1 Column 2 Column 3 Column 4
Reference in International
Title Corresponding
Clause 2 Standard Edition
European Standard
Edition
ISO 25119-1 ISO 25119-1:2018 Tractors and machinery for EN ISO 25119-1:2023
agriculture and forestry —
ISO 25119- EN ISO 25119-
Safety-related parts of
1:2018/A1:2020 1:2023/A1:2023
control
systems — Part 1: General
principles for design and
development
ISO 25119-2:2019 ISO 25119-2:2019 Tractors and machinery for EN ISO 25119-2:2023
agriculture and forestry —
Safety-related parts of
control systems — Part 2:
Concept phase
ISO 25119-4:2018 ISO 25119-4:2018 Tractors and machinery for EN ISO 25119-4:2023
agriculture and forestry —
ISO 25119- EN ISO 25119-
Safety-related parts of
4:2018/A1:2020 4:2023/A1:2023
control systems Part 4:
production, operation,
modification and supporting
processes
The documents listed in the Column 1 of table ZA.2, in whole or in part, are normatively referenced in
this document, i.e. are indispensable for its application. The achievement of the presumption of
conformity is subject to the application of the edition of Standards as listed in Column 4 or, if no
European Standard Edition exists, the International Standard Edition given in  Column 2 of table
ZA.2.
WARNING 1 — Presumption of conformity stays valid only as long as a reference to this European
Standard is maintained in the list published in the Official Journal of the European Union. Users of
this standard should consult frequently the latest list published in the Official Journal of the
European Union.
WARNING 2 — Other Union legislation may be applicable to the product(s) falling within the scope
of this standard.
INTERNATIONAL ISO
STANDARD 25119-3
Second edition
2018-10
Tractors and machinery for
agriculture and forestry — Safety-
related parts of control systems —
Part 3:
Series development, hardware and
software
Tracteurs et matériels agricoles et forestiers — Parties des systèmes
de commande relatives à la sécurité —
Partie 3: Développement en série, matériels et logiciels
Reference number
ISO 25119-3:2018(E)
©
ISO 2018
ISO 25119-3:2018(E)
© ISO 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Fax: +41 22 749 09 47
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO 2018 – All rights reserved

ISO 25119-3:2018(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 2
3 Terms and definitions . 2
4 Abbreviated terms . 2
5 System design . 3
5.1 Objectives. 3
5.2 General . 3
5.3 Prerequisites . 4
5.4 Requirements . 4
5.4.1 Structuring safety requirements . 4
5.4.2 Technical safety concept . 5
5.5 Work products . 7
6 Hardware . 7
6.1 Objectives. 7
6.2 General . 7
6.3 Prerequisites . 7
6.4 Requirements . 7
6.5 Hardware categories . 9
6.6 Work products . 9
7 Software .10
7.1 Software development planning .10
7.1.1 Objectives .10
7.1.2 General.10
7.1.3 Prerequisites .10
7.1.4 Requirements .10
7.1.5 Work products .13
7.2 Software safety requirements specification .13
7.2.1 Objectives .13
7.2.2 General.13
7.2.3 Prerequisites .13
7.2.4 Requirements .13
7.2.5 Work products .17
7.3 Software architecture design .17
7.3.1 Objectives .17
7.3.2 General.17
7.3.3 Prerequisites .17
7.3.4 Requirements .17
7.3.5 Work products .19
7.4 Software component design and implementation .19
7.4.1 Objectives .19
7.4.2 General.19
7.4.3 Prerequisites .19
7.4.4 Requirements .19
7.4.5 Work products .29
7.5 Software component testing .29
7.5.1 Objectives .29
7.5.2 General.29
7.5.3 Prerequisites .29
7.5.4 Requirements .29
7.5.5 Work products .37
ISO 25119-3:2018(E)
7.6 Software integration and testing .37
7.6.1 Objectives .37
7.6.2 General.38
7.6.3 Prerequisites .38
7.6.4 Requirements .38
7.6.5 Work products .39
7.7 Software safety testing .40
7.7.1 Objectives .40
7.7.2 General.40
7.7.3 Prerequisites .40
7.7.4 Requirements .40
7.7.5 Work products .44
7.8 Software-based parameterisation .44
7.8.1 Objective . .44
7.8.2 General.44
7.8.3 Prerequisites .45
7.8.4 Requirements .45
7.8.5 Work products .46
Annex A (informative) Example of agenda for assessment of functional safety at AgPL = e .47
Annex B (normative) Independence by software partitioning .49
Bibliography .59
iv © ISO 2018 – All rights reserved

ISO 25119-3:2018(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www .iso
.org/iso/foreword .html.
This document was prepared by Technical Committee ISO/TC 23, Tractors and machinery for agriculture
and forestry, Subcommittee SC 19, Agricultural electronics.
This second edition cancels and replaces the first edition (ISO 25119-3:2010), which has been technically
revised. The main changes compared to the previous edition are as follows:
— the introduction has been modified to add specific information on safety standards;
— the prerequisites of functional safety have been specified;
— Clause 5 has been revised to:
— specify the prerequisites of functional safety, and
— simplify the general requirements of technical safety concepts;
— additional instructions have been added throughout the document to verify consistency of test
specifications and reports;
— Annex B has been changed to a normative annex;
— the document has been editorially revised.
A list of all parts in the ISO 25119 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/members .html.
ISO 25119-3:2018(E)
Introduction
ISO 25119 (all parts) sets out an approach to the assessment, design and verification, for all safety life
cycle activities, of safety-related parts comprising electrical and/or electronic and/or programmable
electronic systems (E/E/PES) on tractors used in agriculture and forestry, and on self-propelled ride-
on machines and mounted, semi-mounted and trailed machines used in agriculture. It is also applicable
to mobile municipal equipment.
A prerequisite to the application of ISO 25119 (all parts) is the completion of a suitable hazard
identification and risk analysis (e.g. ISO 12100) for the entire machine. As a result, an E/E/PES is
frequently assigned to provide safety-related functions that create safety-related parts of control
systems (SRP/CS). These can consist of hardware or software, can be separate or integrated parts of
a control system, and can either perform solely safety-related functions or form part of an operational
function.
In general, the designer (and to some extent, the user) will combine the design and validation of these
SRP/CS as part of the risk assessment. The objective is to reduce the risk associated with a given hazard
(or hazardous situation) under all conditions of use of the machine. This can be achieved by applying
various measures (both SRP/CS and non-SRP/CS) with the end result of achieving a safe condition.
ISO 25119 (all parts) allocates the ability of safety-related parts to perform a safety-related function
under foreseeable conditions into five performance levels. The performance level of a controlled
channel depends on several factors, including system structure (category), the extent of fault detection
mechanisms (diagnostic coverage), the reliability of components (mean time to dangerous failure,
common-cause failure), design processes, operating stress, environmental conditions and operation
procedures. Three types of failures that can cause E/E/PES malfunctions leading to potential hazardous
situations are considered: systematic, common-cause and random.
In order to guide the designer during design, verification, and to facilitate the assessment of the achieved
performance level, ISO 25119 (all parts) defines an approach based on a classification of architecture
with different design features and specific behaviour in case of a fault.
The performance levels and categories can be applied to the control systems of all kinds of mobile
machines: from simple systems (e.g. auxiliary valves) to complex systems (e.g. steer by wire), as well as
the control systems of protective equipment (e.g. interlocking devices, pressure sensitive devices).
ISO 25119 (all parts) adopts a risk-based approach for the determination of the risks, while providing a
means of specifying the required performance level for the safety-related functions to be implemented
by E/E/PES safety-related channels. It gives requirements for the whole safety life cycle of E/E/PES
(design, validation, production, operation, maintenance, decommissioning), necessary for achieving the
required functional safety for E/E/PES that are linked to the performance levels.
The structure of safety standards in the field of machinery is as follows.
a) Type-A standards (basic safety standards) give basic concepts, principles for design and general
aspects that can be applied to machinery.
b) Type-B standards (generic safety standards) deal with one or more safety aspect(s), or one or more
type(s) of safeguards that can be used across a wide range of machinery:
— type-B1 standards on particular safety aspects (e.g. safety distances, surface temperature, noise);
— type-B2 standards on safeguards (e.g. two-hand controls, interlocking devices, pressure
sensitive devices, guards).
c) Type-C standards (machinery safety standards) deal with detailed safety requirements for a
particular machine or group of machines.
This document is a type-B1 standard as stated in ISO 12100.
vi © ISO 2018 – All rights reserved

ISO 25119-3:2018(E)
This document is of relevance, in particular, for the following stakeholder groups representing the
market players with regard to machinery safety:
— machine manufacturers (small, medium and large enterprises);
— health and safety bodies (regulators, accident prevention organizations, market surveillance, etc.).
Others can be affected by the level of machinery safety achieved with the means of the document by the
above-mentioned stakeholder groups:
— machine users/employers (small, medium and large enterprises);
— machine users/employees (e.g. trade unions, organizations for people with special needs);
— service providers, e.g. for maintenance (small, medium and large enterprises);
— consumers (in case of machinery intended for use by consumers).
The above-mentioned stakeholder groups have been given the possibility to participate at the drafting
process of this document.
In addition, this document is intended for standardization bodies elaborating type-C standards.
The requirements of this document can be supplemented or modified by a type-C standard.
For machines which are covered by the scope of a type-C standard and which have been designed and
built according to the requirements of that standard, the requirements of that type-C standard take
precedence.
INTERNATIONAL STANDARD ISO 25119-3:2018(E)
Tractors and machinery for agriculture and forestry —
Safety-related parts of control systems —
Part 3:
Series development, hardware and software
1 Scope
This document sets out general principles for the design and development of safety-related parts of
control systems (SRP/CS) on tractors used in agriculture and forestry and on self-propelled ride-on
machines and mounted, semi-mounted and trailed machines used in agriculture. It can also be applied
to mobile municipal equipment (e.g. street-sweeping machines).
This document is not applicable to:
— aircraft and air-cushion vehicles used in agriculture;
— lawn and garden equipment.
This document specifies the characteristics and categories required of SRP/CS for carrying out their
safety-related functions. It does not identify performance levels for specific applications.
NOTE 1 Machine specific type-C standards can specify performance levels (AgPL) for safety-related functions
in machines within their scope. Otherwise, the specification of AgPL is the responsibility of the manufacturer.
This document is applicable to the safety-related parts of electrical/electronic/programmable
electronic systems (E/E/PES), as these relate to mechatronic systems. It covers the possible hazards
caused by malfunctioning behaviour of E/E/PES safety-related systems, including interaction of these
systems. It does not address hazards related to electric shock, fire, smoke, heat, radiation, toxicity,
flammability, reactivity, corrosion, release of energy, and similar hazards, unless directly caused by
malfunctioning behaviour of E/E/PES safety-related systems. It also covers malfunctioning behaviour
of E/E/PES safety-related systems involved in protective measures, safeguards, or safety-related
functions in response to non-E/E/PES hazards.
Examples included within the scope of this document:
— SRP/CS’s limiting current flow in electric hybrids to prevent insulation failure/shock hazards;
— electromagnetic interference with the SRP/CS;
— SRP/CS’s designed to prevent fire.
Examples not included in the scope of this document:
— insulation failure due to friction that leads to electric shock hazards;
— nominal electromagnetic radiation impacting nearby machine control systems;
— corrosion causing electric cables to overheat.
This document is not applicable to non-E/E/PES systems (e.g. hydraulic, mechanic or pneumatic).
NOTE 2 See also ISO 12100 for design principles related to the safety of machinery.
This document is not applicable to safety related parts of control systems manufactured before the
date of its publication.
ISO 25119-3:2018(E)
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 25119-1, Tractors and machinery for agriculture and forestry — Safety-related parts of control
systems — Part 1: General principles for design and development
ISO 25119-2:2018, Tractors and machinery for agriculture and forestry — Safety-related parts of control
systems — Part 2: concept phase
ISO 25119-4:2018, Tractors and machinery for agriculture and forestry — Safety-related parts of control
systems — Part 4: Production, operation, modification and supporting processes
3 Terms and definitions
For the purposes of this document, the terms and definitions in ISO 25119-1 apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https: //www .iso .org/obp
— IEC Electropedia: available at http: //www .electropedia .org/
4 Abbreviated terms
For the purposes of this document, the following abbreviated terms apply.
AgPL agricultural performance level
AgPL required agricultural performance level
r
CAD computer-aided design
Cat hardware category
CCF common-cause failure
DC diagnostic coverage
DC average diagnostic coverage
avg
ECU electronic control unit
ETA event tree analysis
E/E/PES electrical/electronic/programmable electronic systems
EMC electromagnetic compatibility
FMEA failure mode and effects analysis
FSM functional safety management
FTA fault tree analysis
HARA hazard analysis and risk assessment
HIL hardware in the loop
2 © ISO 2018 – All rights reserved

ISO 25119-3:2018(E)
MTTF mean time to failure
MTTF mean time to dangerous failure
D
MTTF mean time to dangerous failure for each channel
DC
PES programmable electronic system
QM quality measures
RAM random-access memory
SOP start of production
SRL software requirement level
SRP safety-related parts
SRP/CS safety-related parts of control systems
UML unified modelling language
5 System design
5.1 Objectives
The objective is to define a system design for producing a detail design that fulfils the safety
requirements for the entire safety-related system.
5.2 General
Safety requirements constitute all requirements aimed at achieving and ensuring functional safety.
During the safety life cycle, safety requirements are detailed and specified in ever greater detail at
hierarchical levels. The different levels for safety requirements are illustrated in Figure 1. For the
overall representation of the procedure for developing safety requirements, see also 5.4. In order to
support management of safety requirements, the use of suitable tools for requirements management is
recommended.
Annex A provides guidance for an example agenda
...