IEC 61508 is the foundational international functional safety standard published by the International Electrotechnical Commission (IEC), specifying systematic requirements for the full safety lifecycle of electrical, electronic, and programmable electronic (E/E/PE) safety-related systems across all industry sectors. It introduces the Safety Integrity Level (SIL 1–4) framework as a quantitative measure of risk reduction, mandating specific probabilistic failure-rate targets and qualitative development-process constraints for each level. The standard governs hardware, software, and system-level requirements from hazard identification and risk assessment through design, validation, operation, and decommissioning. Sector-specific derivative standards—including ISO 26262 (automotive), EN 50128 (rail), IEC 62061 (machinery), and IEC 62443 (industrial cybersecurity)—inherit its SIL concepts and lifecycle structure.
Overview
- IEC 61508 (second edition 2010, FDIS 2025) is structured in seven parts:
- Part 1: General requirements — scope, objectives, and overall safety management
- Part 2: Requirements for E/E/PE safety-related systems (hardware)
- Part 3: Software requirements for safety-related systems
- Part 4: Definitions and abbreviations
- Part 5: Examples of methods for the determination of safety integrity levels
- Part 6: Guidelines on the application of Parts 2 and 3
- Part 7: Overview of techniques and measures
- The standard applies across all sectors where Programmable Logic Controllers, microcontrollers, Fieldbus networks, and FPGA-based controllers implement safety functions.
- Its sector-agnostic scope distinguishes it from domain-specific standards; it acts as the “umbrella” from which all functional safety derivatives are derived.
- Why it matters: industrial accidents from inadequately controlled Risk Assessment in E/E/PE systems have historically been catastrophic. IEC 61508 established a systematic, evidence-based approach now used globally in process industries, manufacturing, railways, nuclear, and increasingly in automotive and aerospace.
Key Components
Safety Integrity Level (SIL)
- The central risk-reduction concept quantifying the required reliability of a Safety Function.
- SIL 1: PFDavg 10⁻² to 10⁻¹ (probability of dangerous failure on demand)
- SIL 2: PFDavg 10⁻³ to 10⁻²
- SIL 3: PFDavg 10⁻⁴ to 10⁻³
- SIL 4: PFDavg 10⁻⁵ to 10⁻⁴ — the highest achievable level
- Safety Integrity Level assignment results from systematic Hazard and Risk Assessment.
Safety Lifecycle
- IEC 61508 mandates a full Safety Lifecycle spanning concept, overall scope definition, hazard and risk analysis, safety requirements, realisation, operation, maintenance, and decommissioning.
- Each phase produces documented evidence contributing to the Safety Case.
Hazard and Risk Assessment Methods
- HAZOP (Hazard and Operability Study) — structured systematic examination of process deviations
- Fault Tree Analysis — top-down deductive analysis of failure paths
- Failure Mode and Effects Analysis — bottom-up analysis of component failure effects
- Event Tree Analysis — analysis of initiating event consequence chains
- Risk graphs and calibrated risk matrices for SIL determination
Hardware Requirements (Part 2)
- Safe Failure Fraction (SFF) and architectural constraints on hardware fault tolerance
- Diagnostic Coverage thresholds per SIL
- Common-Cause Failure (CCF) analysis and beta-factor models
- Subsystem architecture requirements (Type A vs Type B components)
- Mean Time To Fail Dangerously (MTTFd) calculations
Software Requirements (Part 3)
- Techniques classified as “highly recommended (HR)” vs “recommended (R)” per SIL
- At SIL 3–4: Formal Methods (Z notation, B-Method, Statecharts), structured programming, defensive programming, software diversity
- At SIL 1–2: semi-formal methods, Model-Based Design, structured testing
- Coding standards, Static Analysis, and dynamic testing requirements
- Software safety lifecycle with mandatory Traceability from requirements to test evidence
Functional Safety Management
- Mandatory Independent Safety Assessment at higher SIL levels
- Functional Safety Audit and Functional Safety Assessment processes
- Competence requirements for personnel involved in safety-related development
- Documentation discipline enforced throughout the Safety Lifecycle
Applications and Use Cases
Process Industry
- Safety Instrumented Systems (SIS) in oil, gas, and chemical plants — emergency shutdown systems (ESD), fire and gas detection, high-integrity pressure protection systems (HIPPS)
- Safety Instrumented Functions (SIF) engineered to meet SIL 2 or SIL 3 targets
- Integration with Process Safety Management and HAZOP studies
Machinery and Manufacturing
- Safety controllers and safety-rated PLCs implementing Machine Safety functions
- IEC 62061 applies IEC 61508 principles directly to machinery sector
- Emergency stop circuits, light curtains, two-hand controls — all assessed against SIL requirements
Railway
- EN 50128 adapts IEC 61508 software requirements for railway control and protection systems
- Train control, signalling systems, interlocking software assessed at SIL 2–4
Automotive (Bridge)
- ISO 26262 translates IEC 61508 into Automotive Safety Integrity Levels (ASIL A–D) for road vehicles
- Increasingly relevant for Autonomous Vehicle systems and advanced driver-assistance systems (ADAS)
Nuclear
- Supplemented by IEC 61513 and IAEA guidance; IEC 61508 provides the baseline safety lifecycle framework
Industrial Cybersecurity (Bridge)
- IEC 62443 intersects IEC 61508 at the convergence of Functional Safety and Cybersecurity Standard
- Security vulnerabilities that could compromise safety functions require analysis under both frameworks
Emerging: AI and Machine Learning
- AI Safety researchers and standards bodies (ISO/IEC TR 5469, IEEE 7001) reference IEC 61508 as baseline, identifying gaps in SIL methodology for probabilistic, Machine Learning models
- Autonomous Systems using neural networks must address distributional shift, lack of determinism, and explainability — areas not fully covered by traditional IEC 61508 techniques
- Active standardisation work extends IEC 61508 to cover AI-based safety functions
Standards and Context
- Published by: International Electrotechnical Commission (IEC), Technical Committee TC 65
- First edition: 1998; Second edition: 2010; FDIS 2025 revision addressing AI and cybersecurity gaps
- Derivative standards family:
- ISO 26262 — functional safety for road vehicles (ASIL A–D mapping from SIL)
- EN 50128 / IEC 62279 — railway software functional safety (SIL 0–4)
- IEC 62061 — functional safety for machinery (SILCL)
- IEC 61511 — functional safety for process industry (SIS)
- IEC 61513 — nuclear power plants
- IEC 62443 — industrial automation and control system security
- IEC 63187 — functional safety for Collaborative Robots
- ISO/IEC TR 5469 — AI and Machine Learning functional safety (under development)
- Relationship to DO-178C: Aviation software safety uses DO-178C (Design Assurance Levels A–E) rather than IEC 61508; the standards share conceptual overlap but differ in structure and regulatory linkage.
- Relationship to Cybersecurity Standards: IEC 62443 security levels do not directly map to SIL; joint analysis is required when cybersecurity threats could compromise Safety Functions — a recognised gap addressed by the IEC 65A/WG12 working group.
- Regulatory adoption: Referenced in EU Machinery Regulation, ATEX directive, and various national health and safety regulations; accepted by HSE (UK), OSHA (USA), and equivalent authorities globally.
Key Concepts Glossary
- SIL (Safety Integrity Level): Discrete level (1–4) specifying the required probability of failure on demand for a Safety Function
- PFDavg: Average probability of dangerous failure on demand — the primary SIL metric for low-demand mode systems
- SFF (Safe Failure Fraction): Proportion of failures that are safe or detected; drives hardware architectural constraints
- CCF (Common-Cause Failure): Failure of multiple redundant channels due to a shared root cause; analysed via beta-factor models
- E/E/PE system: Electrical, Electronic, and Programmable Electronic system — the scope boundary of IEC 61508
- Safety Function: A specific function to be implemented by an E/E/PE safety-related system to achieve or maintain a safe state for the controlled equipment
- Safety Lifecycle: The structured set of activities spanning the entire life of a safety-related system from concept to decommissioning
- EUC (Equipment Under Control): The equipment, machinery, or process being controlled or protected by the safety-related system