What Is IEC 61508?

IEC 61508 is the international standard for the functional safety of electrical, electronic and programmable electronic (E/E/PE) safety-related systems. Published by the International Electrotechnical Commission (IEC), it sets out a generic approach to every safety lifecycle activity for systems built from E/E/PE elements that perform safety functions. It applies to all such systems irrespective of the application, and belongs to no single industry. The edition in force is Edition 2.0, dated April 2010.

The standard states two objectives: to make it easier for the technical committees responsible for particular products and sectors to write their own standards on a common base, and to allow E/E/PE safety-related systems to be developed where no sector or product standard exists (IEC 61508-1:2010, 1.1).

This guide covers what the standard means by functional safety, the concepts it is built on, its scope, its seven parts, the overall safety lifecycle, the activities that apply across the lifecycle, the hardware and software requirements, what conformance means, its relationship to sector and product standards, and the third edition now at its final vote.

What IEC 61508 means by functional safety

The standard's full title is Functional safety of electrical/electronic/programmable electronic safety-related systems, and the abbreviation E/E/PE runs through the whole text. IEC 61508-4, which holds the definitions, defines the equipment under control (EUC) as the equipment, machinery, apparatus or plant used for manufacturing, process, transportation, medical or other activities (IEC 61508-4:2010, 3.2.1). It defines functional safety as "part of the overall safety relating to the EUC and the EUC control system that depends on the correct functioning of the E/E/PE safety-related systems and other risk reduction measures" (3.1.12).

Risk reduction that does not use an E/E/PE system, such as a relief valve, is an "other risk reduction measure" (3.4.2). Such measures are taken into account when deciding what the E/E/PE systems must do, but their own design is outside the standard. IEC 61508 sets out how the dependence on correct functioning is achieved and demonstrated for the part carried by E/E/PE safety-related systems.

Safety functions and safety integrity

E/E/PE safety-related systems and other risk reduction measures both implement safety functions. A safety function is intended to achieve or maintain a safe state for the EUC in respect of a specific hazardous event (IEC 61508-4:2010, 3.5.1). It may be a positive action, such as switching off a motor, or a prevention, such as stopping a motor from starting. A safety-related system is the designated system that implements the required safety functions and is intended to achieve the necessary safety integrity for them (3.4.1). It includes everything needed to carry out the function: sensors, logic, final elements and supporting services such as power supplies.

Two requirements for every safety function. The standard separates what a safety function does, the safety function requirement, from how reliably it must do it, the safety integrity requirement. It stipulates neither for any particular application.

Two kinds of failure. A random hardware failure occurs at a random time and results from degradation mechanisms in the hardware; failure rates from this cause can be predicted with reasonable accuracy. A systematic failure is related in a deterministic way to a certain cause, and can only be eliminated by modifying the design, manufacturing process, operational procedures, documentation or similar (IEC 61508-4:2010, 3.6.5 and 3.6.6). Because systematic failures cannot in general be quantified, the standard treats the two differently. For random hardware failures it sets numerical targets. For systematic failures it sets requirements for avoiding and controlling faults, based on industrial experience, and allows the target to be claimed as achieved if all the relevant requirements have been met.

Safety integrity levels. Safety integrity requirements are specified as one of four safety integrity levels (SILs), SIL 1 to SIL 4. Each is linked to a target failure measure: an average probability of dangerous failure on demand for a function in low demand mode (demands no more than once a year), or an average frequency of dangerous failure per hour for a function in high demand or continuous mode. A safety function carried out by a single E/E/PE safety-related system cannot be credited with a target failure measure lower than 10⁻⁵ on demand or 10⁻⁹ per hour. The standard does not specify the SIL that any safety function needs, nor mandate how it is determined; it provides a risk-based framework and example techniques (IEC 61508-1:2010, Introduction). Our guide What Is a Safety Integrity Level (SIL)? covers SILs in full.

Systematic capability. For elements, the standard defines systematic capability (SC), on a scale of SC 1 to SC 4: a measure of confidence that an element's systematic safety integrity meets the requirements of a specified SIL (IEC 61508-4:2010, 3.5.9).

Fail-safe. The standard does not explicitly use the concept of fail-safe. Fail-safe and inherently safe principles may be applied, provided the relevant requirements are met.

Scope: what it covers and what it does not

IEC 61508 applies to safety-related systems when one or more of them incorporates E/E/PE elements, and covers protection systems and control systems alike. Its main concern is failures that could affect the safety of people or the environment, but it may also be used for E/E/PE systems protecting equipment or product where the consequences of failure are economic (IEC 61508-1:2010, 1.2).

The systems it can be applied to include emergency shutdown, fire and gas, turbine control, gas burner management, crane safe-load indicators, machinery guard interlocking and emergency stopping, dynamic positioning of ships, railway signalling, and variable speed drives used to limit speed. Their technology can be anything from electromechanical relays to programmable electronics.

Several things are explicitly outside its scope (IEC 61508-1:2010, 1.2):

• hazards arising from the E/E/PE equipment itself, such as electric shock;
• E/E/PE systems where a single system can meet the tolerable risk on its own and the safety integrity it needs is below SIL 1;
• medical equipment complying with the IEC 60601 series;
• the SILs required in sector applications, which are left to sector standards;
• detailed human factors requirements for design, although a person can form part of a safety-related system;
• precautions against unauthorised interference, and security policies.

Malevolent and unauthorised action must still be considered when hazards and risks are analysed, and where it is reasonably foreseeable a security threats analysis should be carried out, with the IEC 62443 series referenced for guidance (IEC 61508-1:2010, 7.4.2.3).

Functional safety is one means of dealing with hazards among several. The standard requires consideration to be given to eliminating or reducing hazards, and notes that eliminating them at source, for example by inherent safety principles, is of primary importance, while placing that work outside its own scope (IEC 61508-1:2010, 7.4.2.2).

The seven parts

The standard is published in seven parts, prepared by subcommittee SC 65A, System aspects, of IEC technical committee TC 65, Industrial-process measurement, control and automation. The 2010 parts form Edition 2.0, a technical revision that replaced the first edition, whose parts were published between 1998 and 2000.

• Part 1, IEC 61508-1: General requirements. Normative.
• Part 2, IEC 61508-2: Requirements for E/E/PE safety-related systems. Normative.
• Part 3, IEC 61508-3: Software requirements. Normative.
• Part 4, IEC 61508-4: Definitions and abbreviations. Normative.
• Part 5, IEC 61508-5: Examples of methods for the determination of safety integrity levels. Guidance only.
• Part 6, IEC 61508-6: Guidelines on the application of IEC 61508-2 and IEC 61508-3. Guidance only.
• Part 7, IEC 61508-7: Overview of techniques and measures. Guidance only.

Only Parts 1 to 4 contain normative requirements. Part 1 holds the requirements that apply to all parts: the overall safety lifecycle, documentation, management of functional safety and functional safety assessment. Parts 2 and 3 add specific requirements for hardware and software, and Part 4 holds the definitions. Part 5 explains risk and safety integrity and illustrates methods for determining SILs, among them risk graphs, layer of protection analysis and a hazardous event severity matrix, as simplified examples rather than definitive accounts. Part 6 gives worked guidance on Parts 2 and 3, including hardware failure probability calculation, diagnostic coverage and common cause failure. Part 7 gives an overview of the techniques and measures referred to elsewhere in the standard.

Parts 1 to 4 are basic safety publications under IEC Guide 104. IEC's technical committees have to use them when preparing any product or sector standard that has E/E/PE safety-related systems within its scope, and they are also intended for use as stand-alone publications (IEC 61508-1:2010, 1.4).

The overall safety lifecycle

The technical framework of IEC 61508, set out in Part 1, is the overall safety lifecycle (IEC 61508-1:2010, Figure 2). Its sixteen phases each have their own subclause, with objectives, scope, inputs and outputs:

1. Concept
2. Overall scope definition
3. Hazard and risk analysis
4. Overall safety requirements
5. Overall safety requirements allocation
6. Overall operation and maintenance planning
7. Overall safety validation planning
8. Overall installation and commissioning planning
9. E/E/PE system safety requirements specification
10. E/E/PE safety-related systems: realisation
11. Other risk reduction measures: specification and realisation
12. Overall installation and commissioning
13. Overall safety validation
14. Overall operation, maintenance and repair
15. Overall modification and retrofit
16. Decommissioning or disposal

Correct specification of the safety functions matters as much as their integrity, and the early phases of the lifecycle produce that specification. In them the EUC risk is evaluated or estimated for each hazardous event, qualitatively or quantitatively, and an overall safety function is developed for each, described without reference to the technology that will implement it. Allocation then assigns the functions to E/E/PE safety-related systems and other risk reduction measures, and gives each function assigned to an E/E/PE system a target failure measure and a SIL (7.4 to 7.6). The standard applies only where the tolerable risk is met at least in part by an E/E/PE safety-related system.

Phase 10 expands into the E/E/PE system safety lifecycle, the framework for Part 2, and the software safety lifecycle, the framework for Part 3. Phase 11 is outside the standard's scope. The lifecycle figures are simplified views: iteration within and between phases is described as essential, and a different lifecycle may be used provided the objectives and requirements of each clause are met.

Management, competence, verification and assessment

Three activities are not drawn as phases of the lifecycle but apply to every phase: management of functional safety (IEC 61508-1:2010, Clause 6), verification (7.18) and functional safety assessment (Clause 8).

Management of functional safety applies to any organisation responsible for an E/E/PE safety-related system or a lifecycle phase. Such an organisation must appoint people with overall responsibility for the system, its phases and the interfaces with other organisations; specify a policy and strategy for achieving functional safety; and set up procedures covering communication, follow-up of recommendations, analysis of hazardous events, periodic functional safety audits, authorisation of modifications and configuration management. Suppliers must have an appropriate quality management system.

Competence, also covered by Clause 6, is required of everyone involved in any lifecycle activity, including verification, management and assessment: appropriate training, technical knowledge, experience and qualifications, with procedures for refreshing and continued assessment. The rigour of the competence specification increases with the consequences of failure, the SIL and the novelty of the design or application, and competence must be documented (6.2.13 to 6.2.15).

Verification demonstrates for each phase, by review, analysis or test, that its outputs meet its objectives and requirements, against a plan drawn up alongside the development.

Functional safety assessment arrives at a judgement on the adequacy of the functional safety achieved. It covers all phases, including documentation, verification and management, and must be carried out before the hazards are present. The minimum independence of those carrying it out is set by Table 4, graded by consequence, for overall lifecycle phases 1 to 8 and 12 to 16, and by Table 5, graded by SIL or systematic capability, for phases 9 and 10 and the E/E/PE system and software lifecycles. The levels are an independent person, an independent department and an independent organisation. By SIL they rise from an independent person at SIL 1 to an independent organisation at SIL 4, with the choice at SIL 2 and SIL 3 depending also on complexity, novelty and previous experience with a similar design.

An independent organisation does not have to be a certification body, and an internal function separate in management and resources from the development team can meet the requirement. Third-party certification is not a requirement of IEC 61508.

Hardware and software requirements

Phase 10 of the lifecycle, the realisation of the E/E/PE safety-related systems, is governed by Parts 2 and 3. Part 2 applies to any safety-related system containing at least one E/E/PE element, and to every element in it, including sensors, actuators and the operator interface. It refines the E/E/PE system safety requirements specification into a design requirements specification, and sets requirements for design, manufacture, integration, validation and modification, with techniques for avoiding and controlling faults graded by SIL. It is directed mainly at suppliers and in-company engineering departments (IEC 61508-2:2010, 1.1).

A design must meet several sets of requirements together (7.4.2.2): hardware safety integrity, made up of architectural constraints and the quantified effect of random hardware failures; requirements for integrated circuits with on-chip redundancy; systematic capability; behaviour on detection of a fault; and data communication. Systematic capability can be met by Route 1S, compliance with the requirements for avoiding and controlling systematic faults; Route 2S, evidence that the equipment is proven in use; or Route 3S, for pre-existing software elements only. A compliant item supplied for use in safety-related systems has a safety manual (Annex D), documenting the information needed to integrate it into a safety-related system in compliance with the standard.

Part 3 applies to any software forming part of a safety-related system or used to develop one, including operating systems, firmware, communication software and application software, and to the support tools used to develop and configure the system, such as language translators, test tools and configuration management tools (IEC 61508-3:2010, 1.1). It requires the software safety functions and software systematic capability to be specified, and grades its techniques against that capability.

Both parts set out techniques and measures in tables, graded by SIL. In Part 3 each technique is marked for each level as highly recommended (HR), recommended (R), no recommendation, or not recommended (NR). Not using a highly recommended technique, or using a not-recommended one, needs a rationale detailed in safety planning and agreed with the functional safety assessor. Alternatives are marked so that only one of a group has to be satisfied, and other techniques may be used provided the requirements and objectives are met (IEC 61508-3:2010, Annex A). The standard therefore states what has to be achieved and how much rigour is needed, and leaves room in how it is achieved, provided the choice is justified.

What conformance means

To conform to IEC 61508, it must be demonstrated that all the relevant requirements have been satisfied to the required criteria, such as the SIL, and that for each clause all the objectives have been met (IEC 61508-1:2010, 4.1). A requirement written with "shall" must be followed to claim conformance; "should" indicates a recommended course that is not strictly required.

Low-complexity E/E/PE safety-related systems are those in which each component's failure modes are well defined and the behaviour under fault can be completely determined. For them, some requirements may be unnecessary, and exemption is acceptable if justified (4.2). The basic safety publication status of Parts 1 to 4 does not apply to them either.

A supplier's statement that a product conforms to IEC 61508 at a given SIL does not by itself make a system built from it conform. A SIL applies to a safety function, not to an individual component, and the combination of every element in the function, including field equipment and application logic, has to be assessed against the function's target.

Relationship to sector and product standards

The first of the standard's two objectives is a common base for sector and product standards. Those written within the IEC 61508 framework include IEC 61511 for safety instrumented systems in the process industries, IEC 61513 for nuclear power plants, IEC 62061 for machinery, IEC 61800-5-2 for power drive systems, and IEC 62279 (EN 50128 in Europe) for railway software. ISO 26262, published by the International Organization for Standardization (ISO), is an adaptation of IEC 61508 for road vehicle electrical and electronic systems.

In the process sector, the division of work follows the supply chain. IEC 61511 applies to the designers, integrators and users of safety instrumented systems, while manufacturers and suppliers of devices work to IEC 61508. IEC 61511 does not apply to a manufacturer claiming a device is suitable for a safety instrumented system, nor to embedded software or programming in full variability languages; both remain with IEC 61508 (IEC 61511-1:2016, 1 and Figure 2).

According to the 61508 Association, with sector standards in place, the main direct uses of IEC 61508 are the development of products for those sectors, such as programmable controllers, process instruments and variable speed drives, and applications with no sector standard of their own.

Adoption of IEC standards is voluntary for every country. IEC 61508 has been adopted in Europe by CENELEC, the European Committee for Electrotechnical Standardization, as EN 61508, and in the UK as BS EN 61508.

Edition 3

Edition 2 (2010) remains the edition in force until IEC publishes its replacement. On 14 October 2026, IEC's project database listed all seven parts of Edition 3 at the final draft international standard (FDIS) stage, each with a forecast publication date of January 2027. The FDIS of Part 1 (65A/1267/FDIS) was circulated on 2 October 2026, with the voting report expected in November 2026. At FDIS stage national committees vote to approve or reject the text without further technical comment, so January 2027 depends on those votes passing.

IEC's abstract of the Part 1 FDIS lists the significant technical changes from Edition 2:

• the scope clarifies the position of artificial intelligence, human factors and security, with the related requirements limited to the hazard and risk analysis;
• the interfaces between the parts are clarified;
• the distinction between SIL and systematic capability is clarified;
• more detailed requirements are given for the competence of people;
• requirements on levels of independence for functional safety assurance activities are set out in a new Annex B.

Four of the five concern subjects Edition 2 already addresses: security, through the security threats analysis in IEC 61508-1, 7.4.2.3; systematic capability, defined in IEC 61508-4, 3.5.9; competence, in IEC 61508-1, 6.2.13 to 6.2.15; and independence, through the tables for functional safety assessment. The detail will be known only when the text is published. Our news articles follow the revision: IEC 61508 Edition 3: when it is due and what changes and IEC 61508 Edition 3 reaches final vote, with tighter competence rules.

Further documents are being added around the seven parts. The 61508 Association expects the family to have ten main parts once Edition 3 is released, adding IEC 61508-2-1 (complex semiconductors), IEC TR 61508-3-3 (object-oriented software, published as a technical report in 2025; see our news article) and IEC TR 61508-6-1 (hardware or software developed to ISO 26262).

Summary

IEC 61508 is the international standard for the functional safety of E/E/PE safety-related systems, published by the IEC in seven parts, of which Parts 1 to 4 are normative. Edition 2.0 (2010) is in force, and Edition 3 is at its final vote.

In its definition, functional safety is the part of overall safety relating to the EUC that depends on safety-related systems and other risk reduction measures functioning correctly. Each safety function has a functional requirement and an integrity requirement, the latter expressed as one of four SILs. The overall safety lifecycle derives the functions from hazard and risk analysis and allocates them, and Parts 2 and 3 set the hardware and software requirements for realising those assigned to E/E/PE systems. Management of functional safety, competence, verification and functional safety assessment apply throughout.

Conformance means demonstrating that every relevant requirement and objective has been met. Because a SIL applies to a safety function rather than a component, a supplier's conformance claim for a product does not by itself make a system conform. Sector standards such as IEC 61511 and IEC 62061 are written within its framework, and in the process sector device manufacturers work to IEC 61508 while the designers, integrators and users of safety instrumented systems work to IEC 61511.

Sources

• IEC 61508-1:2010, IEC 61508-2:2010, IEC 61508-3:2010, IEC 61508-4:2010, IEC 61508-5:2010 and IEC 61508-6:2010 (Edition 2.0); clauses cited inline
• IEC 61511-1:2016, Clause 1 and Figure 2
• IEC, Functional safety FAQ
• IEC SC 65A project database: IEC 61508-1 Edition 3 (read 14 October 2026)
• ISO 26262-1:2018, abstract
• The 61508 Association, What is IEC 61508?