Title: IEC 61508: Functional Safety of E/E/PE Systems | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/iec-61508 Description: The basic safety publication behind the whole functional safety family: the EUC and the risk gap that sizes a SIL, the sixteen-phase safety lifecycle, PFDavg and PFH across three demand modes, the architectural constraints of Route 1H and Route 2H, the random hardware arithmetic, systematic capability, Part 3 software rigor, and why ASIL D does not equal SIL 3. --- Concept guide · IEC 61508 Parts 1 to 7 · 13 chapters # IEC 61508: Functional Safety of E/E/PE Systems Build the standard from the ground up: the risk gap that sizes a SIL, the lifecycle that attacks systematic failure, the arithmetic that prices random failure, and the honest comparison with ISO 26262. 13 Chapters 7 Parts decoded 16 Lifecycle phases 4 SIL levels Included in Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fiec-61508&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **Why IEC 61508 Exists** 2. 02 **Risk, the EUC and the Safety Function** 3. 03 **The Safety Lifecycle** 4. 04 **SIL: Four Levels, Three Modes** 5. 05 **Getting to the Required SIL** The short version ## Quick answers What is IEC 61508 and how does it relate to ISO 26262? IEC 61508 is the functional safety standard for electrical, electronic and programmable electronic safety-related systems, published in seven parts plus an introductory technical report. Within the IEC system it holds the status of a basic safety publication: it supplies principles intended for use by technical committees and sector standards, which then adapt the lifecycle, integrity targets and systematic rigor into the vocabulary and constraints of one industry. ISO 26262 is the road-vehicle sector standard, with its own item definition, HARA, ASILs and automotive metrics. The two are related but non-interchangeable, and IEC 61508 is not the compliance ancestry an automotive program argues against. Does ASIL D equal SIL 3? No, and every variant of that sentence is wrong. There is no defined mapping between ASIL and SIL, in either standard, in either direction. Some numeric limits coincide with SIL band boundaries on a log axis, which is exactly why the myth survives, but the derivation, the metrics, the lifecycle and the scope all differ, so the claims are not exchangeable. A component assessed for ASIL D has not thereby met SIL 3, and a SIL 3 element is not thereby ASIL D. Chapter 12 works through the comparison row by row and states what may legitimately be reused. Keep going, free - [Article · 9 min read IEC 61508 vs ISO 26262: What Automotive Engineers Need to Know](https://iso26262.academy/blog/iec-61508-vs-iso-26262-automotive-engineers) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course ## Why it pays for itself ### Read a SIL claim without being misled A SIL belongs to a safety function, not to a device. The guide takes apart what a certificate actually asserts, what the safety manual conditions bind you to, and what your loop still owes, which is where most integration money is lost. ### Know exactly what crosses into ISO 26262 Chapter 12 works the boundary properly: failure-mode analysis, failure-rate data, diagnostic descriptions and verification records can support an automotive argument after reinterpretation, while the SIL claim and its demand-mode assumptions never transfer. ### See where the numbers really come from Proof test intervals, proof test coverage and the common cause factor move a result more than another redundant channel does. The quantitative chapters make those levers explicit so you can spot an optimistic calculation before an assessor does. After the course ## What you’ll be able to do ### Derive a SIL Instead of Choosing One Run the risk gap from EUC risk and a recorded tolerable risk down to a required failure measure, and recognize the backwards determination the moment someone starts from the hardware. ### Use the Right Table Every Time Classify a function by demand profile, apply PFDavg or PFH accordingly, and refuse the comparisons that quietly mix a probability with a rate. ### Read Architecture and Arithmetic Together Treat hardware fault tolerance and safe failure fraction as ceilings on a claim, keep the quantitative analysis as a separate obligation, and apply the weakest link rule across the whole chain. ### Separate the Two Failure Species Know which problems yield to redundancy, diagnostics and proof tests, and which yield only to lifecycle rigor, diversity and systematic capability evidence. ### Interrogate a Supplier Certificate Start from the safety manual conditions, check the route and failure data behind the headline, and list what your installation still owes before any claim holds. ### Bridge Into ISO 26262 Honestly Identify what evidence from a 61508 assessment can support an automotive argument after reinterpretation, and state clearly why the SIL claim itself never transfers. The curriculum · 13 chapters ## Chapter by chapter 1. 01 **Why IEC 61508 Exists** The public accidents that showed careful engineers and reliable components are not enough, what functional safety actually means as a slice of overall safety, an honest guide to the seven parts, and the standard's status as a basic safety publication. - Accidents and standardisation milestones - Passive vs active protection - Which part to read, and when 2. 02 **Risk, the EUC and the Safety Function** The three roles the standard casts and why the protection is deliberately not the control system, tolerable risk as a recorded decision rather than a physical constant, and the subtraction that turns a risk gap into a required failure measure. - EUC, control system, safety-related system - Tolerable risk and the ALARP structure - The two halves of a safety function 3. 03 **The Safety Lifecycle** Why systematic failures force a lifecycle rather than a component specification, the sixteen phases as a working reference, the four management instruments an assessor samples first, and documentation as the argument itself. - Where incidents are really born - Verification vs validation vs assessment - Hazard log, requirements spec, safety manual 4. 04 **SIL: Four Levels, Three Modes** What a SIL claims and what it never claims, the two target tables with their different physical units, the demand mode boundary that decides which table applies, and the three misreadings that produce most SIL nonsense in real projects. - PFDavg and PFH as different quantities - Low, high and continuous mode - Functions have SILs, devices do not 5. 05 **Getting to the Required SIL** The methods for measuring the risk gap on a real project: the quantitative route and its honesty requirement, the risk graph and why calibration is mandatory before use, layer of protection analysis and the independence discipline that makes it real. - Quantitative route, risk graph, LOPA - Credit inflation and independence - The one determination direction that is always wrong 6. 06 **The Architectural Constraints** Why a ceiling sits on top of the arithmetic, hardware fault tolerance and what each voting arrangement really buys, the safe failure fraction and its inflation problem, type A and type B elements, and the two routes to an architectural claim. - HFT and voting trade-offs - SFF, and how it can rise dishonestly - Route 1H, Route 2H and the weakest link 7. 07 **Quantifying Random Hardware Failures** The failure rate splits every later number consumes, the sawtooth that proof testing resets and imperfect test coverage never does, how the architecture formulas rank redundancy, and why the common cause factor usually owns the result. - Safe, dangerous, detected, undetected - Proof test interval and coverage - Where the failure rates come from 8. 08 **Systematic Failures and Systematic Capability** The failure species with no rate: why identical redundancy multiplies nothing against a shared design error, the two fronts of avoidance and control, what SC 1 to SC 4 claim, and the three routes to earning that claim. - Random vs systematic, side by side - Avoidance and control measures - Proven in use and its evidence bar 9. 09 **Software Safety: Part 3** Software has no failure rate, so Part 3 replaces probability with process, techniques and evidence scaled by SIL: the software lifecycle and its two-way traceability, how technique recommendations climb, tool classification by failure path, and reused code. - No lambda for code - Technique rigor by SIL - Tool classes and the software safety manual 10. 10 **The Safety Loop End to End** Reassembling the function, because nothing you can buy carries the claim. Everything in the demand path counts, a real loop walked as hardware rather than blocks, what a certified element gives you and what it leaves entirely to the integrator. - The loop is the unit of the claim - Certificate vs safety manual - De-energize to trip and its price 11. 11 **Worked Example: High-Pressure Protection** One overpressure protection loop taken through the whole page: a target inherited from the risk analysis, a first attempt that fails for two independent reasons, a redesign that passes, and what stretching the maintenance calendar does to the margin. - Target first, hardware second - Where the budget actually goes - Proof testing as a safety parameter 12. 12 **Certification and the Standards Family** What a certificate is and is not, the sector standards that reuse the framework and what each one changes, and the ISO 26262 comparison done properly, including exactly what a 61508-certified part transfers into an automotive argument. - Reading a certificate backwards - The sector family in one table - Why ASIL D does not equal SIL 3 13. 13 **Pitfalls, Myths and a Decision Guide** The recurring mistakes assessors meet every year, the four choices every project has to make deliberately rather than by habit, and the questions that open most functional safety assessments. - The myth wall - Four project decisions - The assessor's first questions Built for ## Who this guide is for - Automotive safety engineers evaluating a 61508-certified MCU, watchdog, power device or software element - Suppliers who must serve several sectors from one functional safety argument - Engineers moving between process, machinery, rail or drives work and road vehicles - Safety managers who need to answer SIL questions from customers and auditors precisely - Anyone who has been told that ASIL D equals SIL 3 and needs the accurate answer ## Frequently Asked Questions Common questions about IEC 61508: Functional Safety of E/E/PE Systems It is computed, not chosen. Estimate the risk of the equipment under control with no protection, fix a tolerable risk figure as an explicit recorded decision, and the distance between the two is the necessary risk reduction. Other technology and external measures take their share of that factor, and whatever remains is the share the safety function must deliver, which lands in one of the four SIL bands. The guide covers the methods used to measure that gap on a real project, including the quantitative route, the risk graph with its calibration warning, and layer of protection analysis, and it names the one determination direction that is always wrong: starting from the hardware you already intend to buy. They are different physical quantities for different operating modes, and mixing them is one of the most common errors in real project documents. For a function that is called on only rarely, the target is PFDavg: how likely the function is to fail dangerously at the moment it is needed, averaged over time, which is a plain probability with no unit. For high demand or continuous operation, the target is the average frequency of dangerous failure per hour, which is a rate with a dimension despite its historical name. The mode is a property of the application rather than of the equipment, so the same device changes tables when it changes jobs. Chapter 4 sets out both tables, the boundary between the modes, and the three misreadings that follow from ignoring them. No. Certification is voluntary under IEC 61508 and attaches to an element within a precisely stated scope. A product certificate does not certify your application. What arrives is genuinely valuable raw material: failure-rate splits, an architectural route, a systematic capability claim and a safety manual full of conditions. What does not arrive is your loop, the application fit, the environment, the common cause question across redundant channels, the proof test procedure that has to achieve the coverage the analysis assumed, and the wiring and supervision the certifier never saw. If a required safety manual condition is not met, the claim cannot simply be relied on. Thirteen chapters. It opens with the accidents that made the standard necessary and an honest map of the seven parts, then builds the risk gap and the anatomy of a safety function, the sixteen-phase safety lifecycle with its management and documentation obligations, the SIL bands across three demand modes, and the methods for determining a required SIL. The quantitative core covers the architectural constraints, random hardware failure arithmetic, systematic capability and Part 3 software rigor. It closes with the full safety loop, a worked high-pressure protection example, certification and the standards family including the ISO 26262 comparison, and a pitfalls chapter with a decision guide. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fiec-61508&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)