IEC 61508: Functional Safety of E/E/PE Systems

IEC 61508 is the functional safety standard for electrical, electronic and programmable electronic safety-related systems, published in seven parts plus an introductory technical report. Within the IEC system it holds the status of a basic safety publication: it supplies principles intended for use by technical committees and sector standards, which then adapt the lifecycle, integrity targets and systematic rigor into the vocabulary and constraints of one industry. ISO 26262 is the road-vehicle sector standard, with its own item definition, HARA, ASILs and automotive metrics. The two are related but non-interchangeable, and IEC 61508 is not the compliance ancestry an automotive program argues against.

No, and every variant of that sentence is wrong. There is no defined mapping between ASIL and SIL, in either standard, in either direction. Some numeric limits coincide with SIL band boundaries on a log axis, which is exactly why the myth survives, but the derivation, the metrics, the lifecycle and the scope all differ, so the claims are not exchangeable. A component assessed for ASIL D has not thereby met SIL 3, and a SIL 3 element is not thereby ASIL D. Chapter 12 works through the comparison row by row and states what may legitimately be reused.

It is computed, not chosen. Estimate the risk of the equipment under control with no protection, fix a tolerable risk figure as an explicit recorded decision, and the distance between the two is the necessary risk reduction. Other technology and external measures take their share of that factor, and whatever remains is the share the safety function must deliver, which lands in one of the four SIL bands. The guide covers the methods used to measure that gap on a real project, including the quantitative route, the risk graph with its calibration warning, and layer of protection analysis, and it names the one determination direction that is always wrong: starting from the hardware you already intend to buy.

They are different physical quantities for different operating modes, and mixing them is one of the most common errors in real project documents. For a function demanded rarely, the target is the average probability of dangerous failure on demand, a dimensionless probability. For high demand or continuous operation, the target is the average frequency of dangerous failure per hour, which is a rate with a dimension despite its historical name. The mode is a property of the application rather than of the equipment, so the same device changes tables when it changes jobs. Chapter 4 sets out both tables, the boundary between the modes, and the three misreadings that follow from ignoring them.

No. Certification is voluntary under IEC 61508 and attaches to an element within a precisely stated scope. A product certificate does not certify your application. What arrives is genuinely valuable raw material: failure-rate splits, an architectural route, a systematic capability claim and a safety manual full of conditions. What does not arrive is your loop, the application fit, the environment, the common cause question across redundant channels, the proof test procedure that has to achieve the coverage the analysis assumed, and the wiring and supervision the certifier never saw. If a required safety manual condition is not met, the claim cannot simply be relied on.

Thirteen chapters. It opens with the accidents that made the standard necessary and an honest map of the seven parts, then builds the risk gap and the anatomy of a safety function, the sixteen-phase safety lifecycle with its management and documentation obligations, the SIL bands across three demand modes, and the methods for determining a required SIL. The quantitative core covers the architectural constraints, random hardware failure arithmetic, systematic capability and Part 3 software rigor. It closes with the full safety loop, a worked high-pressure protection example, certification and the standards family including the ISO 26262 comparison, and a pitfalls chapter with a decision guide.