IEC 61508

Short description: International standard for safety-related systems

This article includes a list of references, but its sources remain unclear because it has insufficient inline citations. Please help to improve this article by introducing more precise citations. (April 2021) (Learn how and when to remove this template message)

|

IEC 61508 is an international standard published by the International Electrotechnical Commission (IEC) consisting of methods on how to apply, design, deploy and maintain automatic protection systems called safety-related systems. It is titled Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems (E/E/PE, or E/E/PES).

IEC 61508 is a basic functional safety standard applicable to all industries. It defines functional safety as: "part of the overall safety relating to the EUC (Equipment Under Control) and the EUC control system which depends on the correct functioning of the E/E/PE safety-related systems, other technology safety-related systems and external risk reduction facilities." The fundamental concept is that any safety-related system must work correctly or fail in a predictable (safe) way.

The standard has two fundamental principles:

1. An engineering process called the safety life cycle is defined based on best practices in order to discover and eliminate design errors and omissions.
2. A probabilistic failure approach to account for the safety impact of device failures.

The safety life cycle has 16 phases which roughly can be divided into three groups as follows:

1. Phases 1–5 address analysis
2. Phases 6–13 address realisation
3. Phases 14–16 address operation.

All phases are concerned with the safety function of the system.

The standard has seven parts:

* Parts 1–3 contain the requirements of the standard (normative)
* Part 4 contains definitions
* Parts 5–7 are guidelines and examples for development and thus informative.

Central to the standard are the concepts of probabilistic risk for each safety function. The risk is a function of frequency (or likelihood) of the hazardous event and the event consequence severity. The risk is reduced to a tolerable level by applying safety functions which may consist of E/E/PES, associated mechanical devices, or other technologies. Many requirements apply to all technologies but there is strong emphasis on programmable electronics especially in Part 3.

IEC 61508 has the following views on risks:

* Zero risk can never be reached, only probabilities can be reduced
* Non-tolerable risks must be reduced (ALARP)
* Optimal, cost effective safety is achieved when addressed in the entire safety lifecycle

Specific techniques ensure that mistakes and errors are avoided across the entire life-cycle. Errors introduced anywhere from the initial concept, risk analysis, specification, design, installation, maintenance and through to disposal could undermine even the most reliable protection. IEC 61508 specifies techniques that should be used for each phase of the life-cycle. The seven parts of the first edition of IEC 61508 were published in 1998 and 2000. The second edition was published in 2010.

## Contents

* 1 Hazard and risk analysis
* 2 Safety integrity level
* 2.1 Probabilistic analysis
* 3 IEC 61508 certification
* 4 Industry/application specific variants
* 4.1 Automotive
* 4.2 Rail
* 4.3 Process industries
* 4.4 Power plants
* 4.5 Machinery
* 5 Testing software
* 6 See also
* 7 References
* 8 Further reading
* 8.1 Related safety standards
* 8.2 Textbooks
* 9 External links

## Hazard and risk analysis

The standard requires that hazard and risk assessment be carried out for bespoke systems: 'The EUC (equipment under control) risk shall be evaluated, or estimated, for each determined hazardous event'.

The standard advises that 'Either qualitative or quantitative hazard and risk analysis techniques may be used' and offers guidance on a number of approaches. One of these, for the qualitative analysis of hazards, is a framework based on 6 categories of likelihood of occurrence and 4 of consequence.

Categories of likelihood of occurrence

Category | Definition | Range (failures per year)

|
|

Frequent | Many times in lifetime | > 10−3
Probable | Several times in lifetime | 10−3 to 10−4
Occasional | Once in lifetime | 10−4 to 10−5
Remote | Unlikely in lifetime | 10−5 to 10−6
Improbable | Very unlikely to occur | 10−6 to 10−7
Incredible | Cannot believe that it could occur | < 10−7

Consequence categories

Category | Definition

|

Catastrophic | Multiple loss of life
Critical | Loss of a single life
Marginal | Major injuries to one or more persons
Negligible | Minor injuries at worst

These are typically combined into a risk class matrix

| Consequence

|

Likelihood | Catastrophic | Critical | Marginal | Negligible
Frequent | I | I | I | II
Probable | I | I | II | III
Occasional | I | II | III | III
Remote | II | III | III | IV
Improbable | III | III | IV | IV
Incredible | IV | IV | IV | IV

Where:

* Class I: Unacceptable in any circumstance;
* Class II: Undesirable: tolerable only if risk reduction is impracticable or if the costs are grossly disproportionate to the improvement gained;
* Class III: Tolerable if the cost of risk reduction would exceed the improvement;
* Class IV: Acceptable as it stands, though it may need to be monitored.

## Safety integrity level

The safety integrity level (SIL) provides a target to attain for each safety function. A risk assessment effort yields a target SIL for each safety function. For any given design the achieved SIL is evaluated by three measures:

1\. Systematic Capability (SC) which is a measure of design quality. Each device in the design has an SC rating. The SIL of the safety function is limited to smallest SC rating of the devices used. Requirement for SC are presented in a series of tables in Part 2 and Part 3. The requirements include appropriate quality control, management processes, validation and verification techniques, failure analysis etc. so that one can reasonably justify that the final system attains the required SIL.

2\. Architecture Constraints which are minimum levels of safety redundancy presented via two alternative methods - Route 1h and Route 2h.

3\. Probability of Dangerous Failure Analysis[1]

### Probabilistic analysis

The probability metric used in step 3 above depends on whether the functional component will be exposed to high or low demand:

* high demand is defined as more than once per year and low demand is defined as less than or equal to once per year (IEC-61508-4).
* For functions that operate continuously (continuous mode) or functions that operate frequently (high demand mode), SIL specifies an allowable frequency of dangerous failure.
* For functions that operate intermittently (low demand mode), SIL specifies an allowable probability that the function will fail to respond on demand.

Note the difference between function and system. The system implementing the function might be in operation frequently (like an ECU for deploying an air-bag), but the function (like air-bag deployment) might be in demand intermittently.

SIL |  Low demand mode:
average probability of failure on demand  |  High demand or continuous mode:
probability of dangerous failure per hour

|
|

1 | ≥ 10−2 to < 10−1 | ≥ 10−6 to < 10−5
2 | ≥ 10−3 to < 10−2 | ≥ 10−7 to < 10−6
3 | ≥ 10−4 to < 10−3 | ≥ 10−8 to < 10−7 (1 dangerous failure in 1140 years)
4 | ≥ 10−5 to < 10−4 | ≥ 10−9 to < 10−8

## IEC 61508 certification

Certification is third party attestation that a product, process, or system meets all requirements of the certification program. Those requirements are listed in a document called the certification scheme. IEC 61508 certification programs are operated by impartial third party organizations called certification bodies (CB). These CBs are accredited to operate following other international standards including ISO/IEC 17065 and ISO/IEC 17025. Certification bodies are accredited to perform the auditing, assessment, and testing work by an accreditation body (AB). There is often one national AB in each country. These ABs operate per the requirements of ISO/IEC 17011, a standard that contains requirements for the competence, consistency, and impartiality of accreditation bodies when accrediting conformity assessment bodies. ABs are members of the International Accreditation Forum (IAF) for work in management systems, products, services, and personnel accreditation or the International Laboratory Accreditation Cooperation (ILAC) for laboratory accreditation. A Multilateral Recognition Arrangement (MLA) between ABs will ensure global recognition of accredited CBs. IEC 61508 certification programs have been established by several global Certification Bodies. Each has defined their own scheme based upon IEC 61508 and other functional safety standards. The scheme lists the referenced standards and specifies procedures which describes their test methods, surveillance audit policy, public documentation policies, and other specific aspects of their program. IEC 61508 certification programs are being offered globally by several recognized CBs including exida, Intertek, SGS-TÜV Saar, TÜV Nord, TÜV Rheinland, TÜV SÜD and UL.

## Industry/application specific variants

### Automotive

ISO 26262 is an adaptation of IEC 61508 for Automotive Electric/Electronic Systems. It is being widely adopted by the major car manufacturers.[2]

Before the launch of ISO 26262, the development of software for safety related automotive systems was predominantly covered by the Motor Industry Software Reliability Association (MISRA) guidelines.[3] The MISRA project was conceived to develop guidelines for the creation of embedded software in road vehicle electronic systems.[3] A set of guidelines for the development of vehicle based software was published in November 1994.[4] This document provided the first automotive industry interpretation of the principles of the, then emerging, IEC 61508 standard.[3]

Today MISRA is most widely known for its guidelines on how to use the C and C++ languages.[5] MISRA C has gone on to become the de facto standard for embedded C programming in the majority of safety-related industries, and is also used to improve software quality even where safety is not the main consideration.

### Rail

IEC 62279 provides a specific interpretation of IEC 61508 for railway applications. It is intended to cover the development of software for railway control and protection including communications, signalling and processing systems. EN 50128 and EN 50657 are equivalent CENELEC standards of IEC 62279.[6]

### Process industries

The process industry sector includes many types of manufacturing processes, such as refineries, petrochemical, chemical, pharmaceutical, pulp and paper, and power. IEC 61511 is a technical standard which sets out practices in the engineering of systems that ensure the safety of an industrial process through the use of instrumentation.

### Power plants

IEC 61513 provides requirements and recommendations for the instrumentation and control for systems important to safety of nuclear power plants. It indicates the general requirements for systems that contain conventional hardwired equipment, computer-based equipment or a combination of both types of equipment. An overview list of safety norms specific for nuclear power plants is published by ISO.[7]

### Machinery

IEC 62061 is the machinery-specific implementation of IEC 61508. It provides requirements that are applicable to the system level design of all types of machinery safety-related electrical control systems and also for the design of non-complex subsystems or devices.

## Testing software

Software written in accordance with IEC 61508 may need to be unit tested, depending up on the SIL it needs to achieve. The main requirement in Unit Testing is to ensure that the software is fully tested at the function level and that all possible branches and paths are taken through the software. In some higher SIL level applications, the software code coverage requirement is much tougher and an MC/DC code coverage criterion is used rather than simple branch coverage. To obtain the MC/DC (modified condition/decision coverage) coverage information, one will need a Unit Testing tool, sometimes referred to as a Software Module Testing tool.

## See also

* Functional safety
* Safety standards
* FMEDA
* Spurious trip level
* Time-triggered system (A software architecture used to achieve IEC 61508 compliance)
* Software quality

## References

1. ↑ Control Systems Safety Evaluation and Reliability. ISA. 2010. ISBN 978-1-934394-80-9.
2. ↑ Hamann, Reinhold; Sauler, Jürgen; Kriso, Stefan; Grote, Walter; Mössinger, Jürgen (2009-04-20). "Application of ISO 26262 in Distributed Development ISO 26262 in Reality" (in en). SAE Technical Paper Series (Warrendale, PA: SAE International) 1. doi:10.4271/2009-01-0758.
3. ↑ 3.0 3.1 3.2 "MISRA Web site > MISRA Home > A brief history of MISRA". https://www.misra.org.uk/MISRAHome/AbriefhistoryofMISRA/tabid/69/Default.aspx.
4. ↑ Development Guidelines for Vehicle Based Software. MISRA. 1994. ISBN 0-9524156-0-7.
5. ↑ "MISRA Web site > News". https://www.misra.org.uk/News/tabid/59/Default.aspx.
6. ↑ Hadj-Mabrouk, Habib (1 November 2020). "Application of Case-Based Reasoning to the safety assessment of critical software used in rail transport". Safety Science 131. doi:10.1016/j.ssci.2020.104928. ISSN 0925-7535. https://www.sciencedirect.com/science/article/abs/pii/S0925753520303258.
7. ↑ "ISO - 27.120.20 - Nuclear power plants. Safety". https://www.iso.org/ics/27.120.20/x/.

## Further reading

### Related safety standards

* ISO 26262 (is an adaption of IEC 61508[1] with minor differences[2])
* IEC 60730[3] (Household)
* DO-178C (Aerospace)

### Textbooks

* W. Goble, "Control Systems Safety Evaluation and Reliability" (3rd Edition ISBN 978-1-934394-80-9, Hardcover, 458 pages).
* I. van Beurden, W. Goble, "Safety Instrumented System Design-Techniques and Design Verification" (1st Edition ISBN 978-1-945541-43-8, 430 pages).
* M.J.M. Houtermans, "SIL and Functional Safety in a Nutshell" (Risknowlogy Best Practices, 1st Edition, eBook in PDF, ePub, and iBook format, 40 Pages) SIL and Functional Safety in a Nutshell - eBook introducing SIL and Functional Safety
* M. Medoff, R. Faller, "Functional Safety - An IEC 61508 SIL 3 Compliant Development Process" (3rd Edition, ISBN 978-1-934977-08-8 Hardcover, 371 pages, www.exida.com)
* C. O'Brien, L. Stewart, L. Bredemeyer, "Final Elements in Safety Instrumented Systems - IEC 61511 Compliant Systems and IEC 61508 Compliant Products" (1st Edition, 2018, ISBN 978-1-934977-18-7, Hardcover, 305 pages, www.exida.com)
* Münch, Jürgen; Armbrust, Ove; Soto, Martín; Kowalczyk, Martin. "Software Process Definition and Management", Springer, 2012.
* M.Punch, "Functional Safety for the Mining Industry – An Integrated Approach Using AS(IEC)61508, AS(IEC) 62061 and AS4024.1." (1st Edition, ISBN 978-0-9807660-0-4, in A4 paperback, 150 pages).
* D.Smith, K Simpson, "Safety Critical Systems Handbook: A Straightforward Guide to Functional Safety, IEC 61508 (2010 Edition) And Related Standards, Including Process IEC 61511 and Machinery IEC 62061 and ISO 13849" (3rd Edition ISBN 978-0-08-096781-3, Hardcover, 288 Pages).

## External links

* IEC 61508-1:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems- Parts 1
* "IEC 61508" at International Electrotechnical Commission
* IEC Functional Safety zone
* 61508 Association A cross-industry group of organizations with an interest in achieving a dependable and cost-effective method for demonstrating compliance with IEC 61508 and related standards.

* v
* t
* e

List of International Electrotechnical Commission standards

IEC standards|

* IEC 60027
* IEC 60034
* IEC 60038
* IEC 60062
* IEC 60063
* IEC 60068
* IEC 60112
* IEC 60228
* IEC 60269
* IEC 60297
* IEC 60309
* IEC 60320
* IEC 60364
* IEC 60446
* IEC 60559
* IEC 60601
* IEC 60870
* IEC 60870-5
* IEC 60870-6
* IEC 60906-1
* IEC 60908
* IEC 60929
* IEC 60958
* AES3
* S/PDIF
* IEC 61030
* IEC 61131
* IEC 61131-3
* IEC 61158
* IEC 61162
* IEC 61334
* IEC 61346
* IEC 61355
* IEC 61360
* IEC 61400
* IEC 61499
* IEC 61508
* IEC 61511
* IEC 61850
* IEC 61851
* IEC 61883
* IEC 61960
* IEC 61968
* IEC 61970
* IEC 62014-4
* IEC 62056
* IEC 62061
* IEC 62196
* IEC 62262
* IEC 62264
* IEC 62304
* IEC 62325
* IEC 62351
* IEC 62365
* IEC 62366
* IEC 62379
* IEC 62386
* IEC 62455
* IEC 62680
* IEC 62682
* IEC 62700

ISO/IEC standards|

* ISO/IEC 646
* ISO/IEC 2022
* ISO/IEC 4909
* ISO/IEC 5218
* ISO/IEC 6429
* ISO/IEC 6523
* ISO/IEC 7810
* ISO/IEC 7811
* ISO/IEC 7812
* ISO/IEC 7813
* ISO/IEC 7816
* ISO/IEC 7942
* ISO/IEC 8613
* ISO/IEC 8632
* ISO/IEC 8652
* ISO/IEC 8859
* ISO/IEC 9126
* ISO/IEC 9293
* ISO/IEC 9592
* ISO/IEC 9593
* ISO/IEC 9899
* ISO/IEC 9945
* ISO/IEC 9995
* ISO/IEC 10021
* ISO/IEC 10116
* ISO/IEC 10165
* ISO/IEC 10179
* ISO/IEC 10646
* ISO/IEC 10967
* ISO/IEC 11172
* ISO/IEC 11179
* ISO/IEC 11404
* ISO/IEC 11544
* ISO/IEC 11801
* ISO/IEC 12207
* ISO/IEC 13250
* ISO/IEC 13346
* ISO/IEC 13522-5
* ISO/IEC 13568
* ISO/IEC 13818
* ISO/IEC 14443
* ISO/IEC 14496
* ISO/IEC 14882
* ISO/IEC 15288
* ISO/IEC 15291
* ISO/IEC 15408
* ISO/IEC 15444
* ISO/IEC 15445
* ISO/IEC 15504
* ISO/IEC 15511
* ISO/IEC 15693
* ISO/IEC 15897
* ISO/IEC 15938
* ISO/IEC 16262
* ISO/IEC 17024
* ISO/IEC 17025
* ISO/IEC 18000
* ISO/IEC 18004
* ISO/IEC 18014
* ISO/IEC 19752
* ISO/IEC 19757
* ISO/IEC 19770
* ISO/IEC 19788
* ISO/IEC 20000
* ISO/IEC 21000
* ISO/IEC 21827
* ISO/IEC 23000
* ISO/IEC 23003
* ISO/IEC 23008
* ISO/IEC 23270
* ISO/IEC 23360
* ISO/IEC 24707
* ISO/IEC 24727
* ISO/IEC 24744
* ISO/IEC 24752
* ISO/IEC 26300
* ISO/IEC 27000
* ISO/IEC 27000-series
* ISO/IEC 27002
* ISO/IEC 27040
* ISO/IEC 29119
* ISO/IEC 33001
* ISO/IEC 38500
* ISO/IEC 42010
* ISO/IEC 80000

Related|

* International Electrotechnical Commission

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/IEC 61508. Read more

|

1. ↑ "Relationship between ISO 26262 and IEC 61508" (in en). https://ez.analog.com/b/engineerzone-spotlight/posts/relationship-between-iso-26262-and-iec-61508.
2. ↑ "Automotive vs Industrial Functional Safety" (in en). https://ez.analog.com/b/engineerzone-spotlight/posts/automotive-vs-industrial-functional-safety.
3. ↑ "IEC 60730-1:2013+AMD1:2015+AMD2:2020 CSV | IEC Webstore". https://webstore.iec.ch/publication/66894.

Retrieved from "https://handwiki.org/wiki/index.php?title=IEC_61508&oldid=4340485"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template