What is IEC 61508?
IEC 61508 is the international foundation standard for functional safety of electrical, electronic and programmable electronic (E/E/PE) safety-related systems, using a risk-based lifecycle and four Safety Integrity Levels (SIL) to define how reliable a safety function must be. It covers the complete process from concept, risk assessment, design and realisation through operation, modification and decommissioning. IEC 61508 is generic and forms the basis for sector standards such as IEC 61511 (process industry), IEC 62061 (machinery) and ISO 26262 (automotive).
IEC 61508 does not prescribe which SIL a function needs. It provides a framework for you to determine that level, demonstrate it and maintain it throughout the system’s entire life.
🧱 Where does IEC 61508 apply?
IEC 61508 applies to any safety function performed by an E/E/PE system: from a simple relay circuit to a safety PLC running software. The standard is prepared by subcommittee 65A of IEC TC 65 and has the status of a basic safety publication under IEC Guide 104. Other technical committees therefore use it as the foundation for their own sector standards.
In practice, two groups use IEC 61508 directly:
- Component manufacturers — developers of safety PLCs, transmitters, valves, safety relays and safety protocols such as PROFIsafe have their products assessed against IEC 61508
- Sectors without their own standard — where no derived sector standard exists, IEC 61508 is applied directly
End users in the process industry usually work to IEC 61511 and buy components certified to IEC 61508.
🕰️ Which editions of IEC 61508 exist?
| Edition | Year | Key characteristics |
|---|---|---|
| Edition 1 | 1998 (parts 1, 3, 4, 5) and 2000 (parts 2, 6, 7) | First generic standard for functional safety, lifecycle and SIL |
| Edition 2 | April 2010 | Technical revision: systematic capability, Route 2H, explicit attention to security in the hazard analysis |
| IEC TR 61508-3-3 | July 2025 | Technical report with guidance on object-oriented software |
| Edition 3 | under development | Drafts commented on and put to the vote in 2025–2026, publication expected around 2027 |
Edition 2 from 2010 is currently the valid version. In Europe it has been adopted as EN 61508:2010, and in the Netherlands it is available as NEN-EN-IEC 61508.
📚 How is IEC 61508 structured?
The standard consists of seven parts. Parts 1 to 3 contain the normative requirements, part 4 the definitions, and parts 5 to 7 are informative.
| Part | Topic | Status |
|---|---|---|
| IEC 61508-1 | General requirements, including the safety lifecycle and functional safety assessment | Normative |
| IEC 61508-2 | Requirements for E/E/PE safety-related systems (hardware) | Normative |
| IEC 61508-3 | Software requirements | Normative |
| IEC 61508-4 | Definitions and abbreviations | Normative |
| IEC 61508-5 | Examples of methods for the determination of SILs | Informative |
| IEC 61508-6 | Guidelines on the application of parts 2 and 3, including calculation examples | Informative |
| IEC 61508-7 | Overview of techniques and measures | Informative |
🔄 How does the safety lifecycle work?
The core of IEC 61508 is the overall safety lifecycle with sixteen phases. Each phase has objectives, requirements, inputs and outputs, and is closed with verification.
| Phase group | Phases | What happens? |
|---|---|---|
| Analysis | 1 Concept, 2 Overall scope definition, 3 Hazard and risk analysis, 4 Overall safety requirements, 5 Safety requirements allocation | Identify hazards, determine the required risk reduction and allocate safety functions with a SIL |
| Planning | 6 Operation and maintenance, 7 Safety validation, 8 Installation and commissioning | Define in advance how the system will be validated and maintained |
| Realisation | 9 E/E/PE system safety requirements specification, 10 E/E/PE system realisation, 11 Other risk reduction measures | Design hardware and software according to parts 2 and 3 |
| Commissioning | 12 Installation and commissioning, 13 Overall safety validation | Demonstrate that the system meets the safety requirements |
| Operation and end of life | 14 Operation, maintenance and repair, 15 Modification and retrofit, 16 Decommissioning or disposal | Monitor performance, control changes, retire safely |
For the hazard analysis in phase 3, teams use methods such as HAZOP and FMEA; for SIL allocation in phase 5, for example LOPA or a risk graph. Alongside the technical lifecycle, the standard requires management of functional safety: demonstrable competence, documentation and an independent functional safety assessment.
🧠 What is a Safety Integrity Level (SIL)?
A SIL is one of four discrete levels of safety integrity for a safety function. The higher the SIL, the lower the tolerable probability of dangerous failure. IEC 61508 distinguishes two modes of operation:
- Low demand — the function is demanded no more than once per year; the measure is the average probability of dangerous failure on demand (PFDavg)
- High demand or continuous — the function is demanded more than once per year or permanently; the measure is the average frequency of dangerous failure per hour (PFH)
| SIL | PFDavg (low demand) | PFH (high demand/continuous, per hour) | Risk reduction factor |
|---|---|---|---|
| SIL 1 | ≥ 10⁻² to < 10⁻¹ | ≥ 10⁻⁶ to < 10⁻⁵ | 10 – 100 |
| SIL 2 | ≥ 10⁻³ to < 10⁻² | ≥ 10⁻⁷ to < 10⁻⁶ | 100 – 1,000 |
| SIL 3 | ≥ 10⁻⁴ to < 10⁻³ | ≥ 10⁻⁸ to < 10⁻⁷ | 1,000 – 10,000 |
| SIL 4 | ≥ 10⁻⁵ to < 10⁻⁴ | ≥ 10⁻⁹ to < 10⁻⁸ | 10,000 – 100,000 |
The risk reduction factor (RRF = 1/PFDavg) applies to low demand only. A claim for a single E/E/PE system may not go below 10⁻⁵ PFDavg or 10⁻⁹ per hour. In industry, SIL 1 to 3 are the levels typically applied; SIL 4 is rare and usually calls for a redesign of the process itself.
🔧 How do you demonstrate that hardware and software achieve a SIL?
Achieving a SIL is more than a calculation. IEC 61508 sets three requirements that must all be met at the same time:
- Quantitative failure measure — the calculated PFDavg or PFH of the complete function (sensor, logic solver, final element) falls within the SIL band
- Architectural constraints — a minimum level of redundancy, expressed as hardware fault tolerance (HFT): with HFT 1, a single fault must not disable the function
- Systematic capability (SC 1–4) — evidence that design faults in hardware and software have been adequately avoided, through Route 1S (development to the standard), 2S (proven in use) or 3S (pre-existing software)
For the architectural constraints the standard offers two routes. Route 1H combines HFT with the safe failure fraction (SFF): the share of failures that are safe or detected by diagnostics. Type A elements are simple elements with well-understood failure behaviour; type B elements are complex ones such as microprocessors.
| SFF (type B) | HFT 0 | HFT 1 | HFT 2 |
|---|---|---|---|
| < 60 % | Not allowed | SIL 1 | SIL 2 |
| 60 % – < 90 % | SIL 1 | SIL 2 | SIL 3 |
| 90 % – < 99 % | SIL 2 | SIL 3 | SIL 4 |
| ≥ 99 % | SIL 3 | SIL 4 | SIL 4 |
For type A, each cell is one SIL higher, up to a maximum of SIL 4; only at SFF ≥ 99 % without fault tolerance does type A also stay at SIL 3. Route 2H uses field reliability data with at least 90 % confidence and then requires a fixed minimum HFT, such as HFT 1 for SIL 3 and HFT 2 for SIL 4. A fail-safe design, in which a fault leads to a safe state, increases the SFF.
🔗 How does IEC 61508 relate to other standards?
| Standard | Sector | Relation to IEC 61508 |
|---|---|---|
| IEC 61511 | Process industry | Sector implementation for safety instrumented systems; edition 1 in 2003, edition 2 in 2016 |
| IEC 62061 | Machinery | Derived standard for safety-related machine control systems; edition 1 in 2005, edition 2 in 2021 |
| ISO 13849-1 | Machinery | Alternative without SIL, using Performance Levels (PL a–e) |
| ISO 26262 | Automotive | Adapted version with ASIL A–D; edition 1 in 2011, edition 2 in 2018 |
| IEC 61513 | Nuclear power plants | Requirements for instrumentation and control important to safety |
| EN 50716 | Railways | Software standard from 2023 that replaces EN 50128 and EN 50657 |
| IEC 61496 | Machinery | Electro-sensitive protective equipment such as light curtains; refers to SIL and PL for integrity |
An ESD system in a refinery therefore falls under IEC 61511, while the safety PLC inside that system was developed as a product to IEC 61508.
🔐 How does IEC 61508 relate to cybersecurity?
Safety and security increasingly overlap, because an attack can disable a safety function. Edition 2 of IEC 61508 therefore requires the hazard analysis to include malevolent or unauthorised action. Where such a threat is reasonably foreseeable, a security threat analysis follows, with a reference to IEC 62443.
- IEC 62443-3-2 — risk assessment and partitioning into zones and conduits, including for the safety network
- IEC 62443-4-1 — secure development processes for suppliers, comparable to the systematic requirements of IEC 61508-3
- IEC TR 63069 (2019) — technical report on applying IEC 61508 and IEC 62443 together
- IEC 61511-1:2016 — explicitly requires a security risk assessment of the SIS in clause 8.2.4
A cybersecurity risk assessment should therefore sit alongside SIL determination, not after it.
🧭 How do you apply IEC 61508 in practice?
- Define the scope — which installation or machine, which hazards, and which sector standard applies. For machinery, start with ISO 12100.
- Analyse hazards and risks — for example with HAZOP or FMEA, and record the tolerable risk.
- Allocate safety functions and SILs — for example with LOPA or a risk graph from part 5: how much risk reduction must the E/E/PE system deliver?
- Write the safety requirements specification — function, response time, safe state, SIL and proof test interval.
- Design and verify — select certified components and check PFDavg/PFH, HFT, SFF and systematic capability.
- Validate and document — record everything in a safety dossier and have an independent functional safety assessment carried out.
- Manage the operating phase — carry out proof tests at the interval assumed in the PFDavg calculation, log failures and handle every change through management of change.
Typical applications include the design of safety PLCs, sensors and actuators with a safety function, safety relays and the integration of complete safety functions. IEC 61508 is not a legal requirement in the Netherlands, but it is regarded as the state of the art. For machinery, it is not IEC 61508 but the harmonised European versions of IEC 62061 and ISO 13849-1 that give a presumption of conformity, currently under the Machinery Directive and in future under the Machinery Regulation (EU) 2023/1230, which applies from 20 January 2027. Products are certified by bodies such as TÜV Rheinland, TÜV SÜD and exida.
❓ Frequently asked questions
Is IEC 61508 legally mandatory?
IEC 61508 is a voluntary international standard and is not directly mandatory by law. Regulators do, however, regard the standard and its derived sector standards as the state of the art for safety systems. If you do not follow IEC 61508 or IEC 61511, you must demonstrate yourself that the risk is controlled equally well.
What is the difference between IEC 61508 and IEC 61511?
IEC 61508 is the generic foundation standard and is aimed mainly at manufacturers who develop safety components and systems. IEC 61511 is the derived standard for end users and integrators in the process industry who design and manage a safety instrumented system. A SIS built to IEC 61511 typically consists of components certified to IEC 61508.
What does SIL 2 mean under IEC 61508?
Under IEC 61508, SIL 2 means that a safety function in low demand mode has an average probability of failure on demand between 10⁻³ and 10⁻². That corresponds to a risk reduction of 100 to 1,000 times. In high demand or continuous mode, the limit lies between 10⁻⁷ and 10⁻⁶ dangerous failures per hour.
Can a component be SIL 3?
Strictly speaking, IEC 61508 assigns a SIL to a safety function, not to an individual component. A component receives a capability, for example “SIL 3 capable”, based on failure data, architecture and systematic capability. Whether the complete function achieves SIL 3 depends on the combination of sensor, logic solver and final element.
When will edition 3 of IEC 61508 be published?
Edition 3 of IEC 61508 is being developed by IEC SC 65A. The drafts were commented on and put to the vote in 2025–2026, and publication is expected around 2027. Until then, edition 2 from 2010 remains the valid version.
Does IEC 61508 cover cybersecurity?
Since edition 2, IEC 61508 has required the hazard analysis to consider malevolent and unauthorised action, followed by a security analysis if such a threat is foreseeable. The standard itself contains no detailed security measures and refers to IEC 62443 for those. IEC TR 63069 describes how the two standards are applied together.
📌 In summary
IEC 61508 is the international foundation standard for functional safety of E/E/PE systems, defining through a sixteen-phase lifecycle and four SIL levels how reliable a safety function must be. With quantitative failure measures, architectural constraints and systematic capability, it underpins IEC 61511, IEC 62061 and ISO 26262, and through its link to IEC 62443 it also underpins the cooperation between safety and security.