IEC 61508 functional safety basics

What IEC 61508 covers

IEC 61508 addresses functional safety of electrical, electronic and programmable electronic (E/E/PE) safety-related systems across all industries, providing a generic framework rather than sector-specific rules. It is a multi-part standard covering general requirements, requirements for E/E/PE systems, software requirements, definitions, and application guidance with examples. Many industry sectors have derived their own standards from it — automotive (ISO 26262), process industry (IEC 61511), machinery (IEC 62061) and rail (EN 5012x) among others — tailoring the generic requirements to sector-specific risks and practice.

Safety Integrity Levels (SIL)

IEC 61508 classifies safety functions by Safety Integrity Level, SIL 1 to SIL 4, with SIL 4 representing the highest integrity and lowest tolerable failure rate. SIL is determined through risk assessment and is expressed against quantitative targets for probability of failure, differentiated for safety functions operating in low-demand mode versus high-demand or continuous mode. A safety function's SIL drives requirements on architecture (including hardware fault tolerance and safe failure fraction), on the rigour of the development process, and on the independence of verification activities.

• SIL 1: the lowest integrity level within the standard's scope, typically for lower-consequence hazards.
• SIL 2 and SIL 3: progressively higher integrity, common in process industry and machinery safety functions.
• SIL 4: reserved for the highest-consequence hazards, rare outside specific sectors such as rail signalling.
• Hardware fault tolerance and safe failure fraction requirements increase with SIL, influencing architecture choices such as redundancy and diagnostics.

The safety lifecycle

IEC 61508 defines an overall safety lifecycle spanning concept, hazard and risk analysis, allocation of safety requirements to systems, realisation (design and implementation), installation, operation and maintenance, and decommissioning. As with its automotive derivative, the practical discipline that makes the lifecycle work is traceability from hazard to safety requirement to design and verification evidence, supported by functional safety management activities such as competence management, configuration management and independent assessment appropriate to the SIL.

Common failure modes in practice

• Applying a sector-specific derivative without understanding the underlying IEC 61508 requirement it tailors, which causes gaps when the derivative is silent on an edge case.
• Quantitative failure targets calculated without adequate justification for the failure data or assumptions used.
• Software developed to a SIL-appropriate process on paper, but without evidence that techniques such as static analysis or code review were consistently applied.
• Independence of verification and validation not matched to the required SIL, particularly for in-house teams verifying their own design.
• Functional safety management processes (competence, configuration control) treated as administrative overhead rather than integral to the safety argument.

What assessors look for

An IEC 61508 assessment typically examines whether the hazard and risk analysis is systematic and current, whether the SIL allocation is justified and consistent with the quantitative or qualitative method used, whether the architecture meets the hardware fault tolerance and diagnostic coverage requirements for its SIL, and whether software development evidence (requirements, design, verification, tool qualification where relevant) is complete and traceable. Functional safety management evidence — competence records, configuration management, and independent assessment reports — is reviewed alongside the technical evidence, since the standard treats organisational discipline as part of the safety argument, not separate from it.

Practical steps

• Determine early whether a sector-specific derivative applies; apply IEC 61508 directly only where no suitable derivative exists.
• Document the hazard and risk assessment method and keep it current through the programme, particularly where SIL allocation depends on quantitative assumptions.
• Match verification independence to the required SIL from the start of planning, since retrofitting independent review is disruptive late in a programme.
• Maintain traceability tooling from safety requirement to design and test evidence throughout development.
• Plan functional safety assessment and competence management as ongoing programme activities, not a final gate.

Frequently asked questions