What is the role of IEC 61508?

IEC 61508 is the generic international standard for the functional safety of electrical, electronic and programmable electronic (E/E/PE) safety-related systems. It is prepared by sub-committee SC 65A (System aspects) of IEC technical committee TC 65. Part 1 states two objectives: to facilitate the writing of product and sector standards, and to allow E/E/PE safety-related systems to be developed where no sector standard exists. It sets the safety integrity levels (SIL 1 to 4), their target failure measures, the overall safety lifecycle, and the requirements against both random hardware failures and systematic failures, including software. IEC 61511 (process) and IEC 62061 (machinery) describe themselves as sector implementations within its framework.

Which edition of IEC 61508 is currently applicable?

Edition 2.0, published on 30 April 2010 for all seven parts, is the current edition. It replaced the first edition, published between December 1998 and May 2000. On 7 October 2026 the IEC web store shows Edition 3.0 of every part at stage PRVC (the vote on the committee draft for vote has closed and its report is being prepared), with forecast publication dates of 22 October 2026 for Parts 1 to 5 and 7, and 21 November 2026 for Part 6. Forecast dates are targets, not commitments; until Edition 3 is actually published, Edition 2 is the one to cite.

How is the SIL of a safety function determined?

The SIL is set per safety function, from a hazard and risk analysis, as the risk reduction that the E/E/PE system must deliver. IEC 61508 does not mandate a method: Part 1 says it provides a risk-based framework and example techniques, and leaves the SIL values for sector applications to sector standards. Part 5 gives informative examples: a quantitative method (Annex D), risk graphs (Annex E), layer of protection analysis, LOPA (Annex F), and a qualitative hazardous event severity matrix (Annex G).

What is the difference between PFD_avg and PFH?

In low demand mode (demands on the safety function no more frequent than once per year), the target is the average probability of dangerous failure on demand, PFD_avg (Part 1, Table 2). In high demand or continuous mode, the target is the average frequency of dangerous failure per hour, PFH (Part 1, Table 3). Each SIL is one decade wide. Part 1 also sets a floor for a single E/E/PE safety-related system: a PFD_avg of 10^-5 in low demand mode and a PFH of 10^-9 per hour in high demand or continuous mode.

What do HFT, SFF, Route 1H and Route 2H mean?

HFT (hardware fault tolerance) is N when N+1 faults can cause loss of the safety function. SFF (safe failure fraction) is the share of failures that are safe or detected dangerous. Under Route 1H, Part 2 Tables 2 and 3 give the maximum SIL allowed for a Type A or Type B element from its HFT and SFF. Route 2H replaces the SFF tables by minimum HFT values per SIL, but only with field reliability data at a higher confidence level (90 %) and, for Type B elements, a diagnostic coverage of at least 60 %.

Do IEC 61511 and IEC 62061 replace IEC 61508 in their sector?

For the system they cover, yes. IEC 61511-1:2016 describes itself as a process sector implementation of IEC 61508:2010 and addresses the specification, design, installation, operation and maintenance of a safety instrumented system. IEC 62061:2021 is a machinery sector standard within the IEC 61508 framework, but it excludes the design of complex programmable electronic subsystems, which therefore stays under IEC 61508. In practice the logic solver, transmitter or safety chip is developed under IEC 61508 and then used by the integrator under the sector standard.

What does "SIL 3 capable" on a datasheet mean?

It is a claim about an element, not a safety function. It usually means the element meets the Route 1H or 2H constraints and the systematic capability needed for use in a SIL 3 safety function, under the conditions written in its safety manual. Part 2 Annex D (and Part 3 Annex D for software) lists what that safety manual for compliant items must contain. The integrator still has to show that the whole function (sensors, logic, final elements) meets the PFD_avg or PFH target and the architectural constraints, and that the manual conditions are respected.

Who assesses an IEC 61508 project, and is there an official certificate?

Part 1 requires a functional safety assessment by people independent of the design. Table 5 sets the minimum independence for the E/E/PE and software phases: from an independent person at SIL 1 to an independent organisation at SIL 4, with SIL 2 and SIL 3 depending on factors such as novelty, complexity and previous experience. There is no IEC certificate: the foreword of each part states that IEC itself does not provide any attestation of conformity, which is left to independent certification bodies.

IEC 61508: generic functional safety and SIL levels

Hugues Orgitello updated 7 Oct 2026 10 min read

IEC 61508 is the generic functional safety standard for electrical, electronic and programmable electronic (E/E/PE) safety-related systems. Its seven parts were first published between December 1998 and May 2000, and the current Edition 2.0 dates from 30 April 2010. In October 2026 Edition 3.0 is close to the end of its drafting: the IEC web store shows all seven parts at the stage that follows the committee draft vote, with forecast publication dates in October and November 2026. The standard defines the safety integrity levels (SIL 1 to 4) and their numerical targets, the safety lifecycle, the architectural constraints against random hardware failures (Routes 1H and 2H), and the systematic capability needed against design and software errors. This page reads the parts against the IEC records, sets out what each part actually contains, and corrects the claims that circulate about the standard and its sector offspring.

Status in October 2026: Edition 2 in force, Edition 3 at the vote stage

Each part has its own IEC catalogue record. All seven Edition 2 parts carry a stability date of 2027, and each record shows an Edition 3.0 project "under development". The table below is what the records showed on 7 October 2026.

Part	Title	First edition	Edition 2.0	Edition 3.0 (IEC web store, 7 October 2026)
IEC 61508-1	General requirements	15 December 1998	30 April 2010	Stage PRVC, forecast 22 October 2026
IEC 61508-2	Requirements for E/E/PE safety-related systems	18 May 2000	30 April 2010	Stage PRVC, forecast 22 October 2026
IEC 61508-3	Software requirements	15 December 1998	30 April 2010	Stage PRVC, forecast 22 October 2026
IEC 61508-4	Definitions and abbreviations	3 December 1998	30 April 2010	Stage PRVC, forecast 22 October 2026
IEC 61508-5	Examples of methods for the determination of safety integrity levels	3 December 1998	30 April 2010	Stage PRVC, forecast 22 October 2026
IEC 61508-6	Guidelines on the application of IEC 61508-2 and IEC 61508-3	18 April 2000	30 April 2010	Stage PRVC, forecast 21 November 2026
IEC 61508-7	Overview of techniques and measures	16 March 2000	30 April 2010	Stage PRVC, forecast 22 October 2026

PRVC is the IEC stage in which the vote on the committee draft for vote (CDV) has closed and the report on that vote is being prepared. A forecast date is a target the committee can move. Until Edition 3 is published, contracts, certificates and sector standards that cite "IEC 61508:2010" refer to Edition 2, and a design team should not anticipate Edition 3 changes it has not read in a published text. This page describes Edition 2.

The committee is TC 65/SC 65A "System aspects" for all seven parts. The Part 1 foreword states that this second edition "cancels and replaces the first edition published in 1998" and that Parts 1 to 4 have the status of basic safety publications according to IEC Guide 104.

What each part contains: a clause and annex map

The table of contents of each Edition 2 part, as shown in the IEC previews, gives a faster map than any summary. The entries below are the ones most often needed in a review.

Where	What it holds	Normative or informative
Part 1, Tables 2 and 3	SIL target failure measures, low demand (PFD_avg) and high demand or continuous (PFH)	Normative
Part 1, Tables 4 and 5	Minimum independence of those carrying out the functional safety assessment, by consequence (Table 4) and by SIL (Table 5)	Normative
Part 2, 7.4.3	Synthesis of elements to achieve the required systematic capability	Normative
Part 2, 7.4.4, Tables 2 and 3	Hardware architectural constraints: maximum SIL for Type A and Type B elements (Route 1H)	Normative
Part 2, 7.4.10	Requirements for proven in use elements	Normative
Part 2, Annex C	Diagnostic coverage and safe failure fraction	Normative
Part 2, Annex D	Safety manual for compliant items	Normative
Part 2, Annex E	Special architecture requirements for integrated circuits with on-chip redundancy	Normative
Part 3, 7.4.4	Support tools, including programming languages	Normative
Part 3, Annex A	Guide to the selection of techniques and measures, per SIL (Tables A.1 to A.10)	Normative
Part 3, Annex B	Detailed tables (coding standards, dynamic analysis and testing, static analysis, and others)	Informative
Part 3, Annex D	Safety manual for compliant items, additional requirements for software elements	Normative
Part 5, Annexes D to G	Quantitative method, risk graphs, LOPA, hazardous event severity matrix	Informative
Part 6, Annex B	Probability calculations for 1oo1, 1oo2, 2oo2, 1oo2D, 1oo3 and 2oo3 architectures	Informative
Part 6, Annex D	Quantifying the effect of hardware-related common cause failures	Informative
Part 7, Annex D	Probabilistic approach to determining software safety integrity for pre-developed software	Informative

Part 1 clause 1.3 describes the split: Parts 2 and 3 add hardware and software requirements, Part 4 holds the definitions, Part 5 gives example methods for SIL determination, Part 6 gives guidelines on Parts 2 and 3, Part 7 is an overview of techniques and measures.

Scope: what IEC 61508 covers and what it leaves out

Part 1 clause 1.2 draws the boundaries more precisely than most summaries:

it applies when one or more safety-related systems incorporate E/E/PE elements, whatever the application;
it does not cover hazards arising from the E/E/PE equipment itself, such as electric shock;
it does not cover a single E/E/PE system that on its own meets the tolerable risk with a required safety integrity below SIL 1;
it requires malevolent and unauthorised actions to be considered in the hazard and risk analysis, while pointing to the IEC 62443 series for security itself;
it does not apply to medical equipment in compliance with the IEC 60601 series.

The standard does not set the SIL of any safety function. Part 1 says it provides a risk-based conceptual framework and example techniques, and that the technical committees of each application sector specify the SIL values in their own standards.

SIL 1 to 4: target failure measures

A SIL is a property of a safety function, with a numerical target that depends on the mode of operation. Part 4 defines low demand mode as a frequency of demands no greater than one per year; above that, or when the function runs continuously, the high demand or continuous mode applies.

SIL	Low demand mode: PFD_avg (Part 1, Table 2)	High demand or continuous mode: PFH, per hour (Part 1, Table 3)
SIL 4	≥ 10^-5 to < 10^-4	≥ 10^-9 to < 10^-8
SIL 3	≥ 10^-4 to < 10^-3	≥ 10^-8 to < 10^-7
SIL 2	≥ 10^-3 to < 10^-2	≥ 10^-7 to < 10^-6
SIL 1	≥ 10^-2 to < 10^-1	≥ 10^-6 to < 10^-5

The introduction to Part 1 explains the lower edge of SIL 4: it is a floor for a single E/E/PE safety-related system, 10^-5 on demand and 10^-9 per hour, considered to be what relatively complex systems can achieve. A single system does not mean a single channel.

Meeting the number is necessary but not sufficient. A SIL claim also needs the hardware architectural constraints (Route 1H or 2H) and the systematic capability. A function whose computed PFD_avg falls in the SIL 3 band but whose software was developed without the Part 3 techniques for SIL 3 does not support a SIL 3 claim.

Random and systematic failures, and systematic capability

IEC 61508 treats two kinds of failure differently.

Random hardware failures happen at random times from degradation mechanisms in the hardware. They are quantified with failure rates split into safe and dangerous, detected and undetected, and they drive the PFD_avg or PFH calculation.
Systematic failures come from errors in specification, design, implementation, installation or operation. Part 1 notes that their probability "cannot in general be quantified"; the standard instead allows the target to be considered achieved for a safety function when all its requirements on avoiding and controlling systematic faults are met.

Edition 2 introduced systematic capability, a scale from SC 1 to SC 4 that expresses the confidence that an element meets the systematic safety integrity of a given SIL. An element used in a SIL 3 function needs SC 3, unless the design combines independent elements as allowed by Part 2 clause 7.4.3. Systematic capability is reached by compliance with the requirements for avoiding and controlling systematic faults, by proven in use evidence, or, for pre-existing software, through the Part 3 route for elements not developed to the standard.

Route 1H: HFT and SFF tables

Under Route 1H, the maximum SIL an element or subsystem can support depends on its hardware fault tolerance (HFT) and its safe failure fraction (SFF), and on whether it is Type A or Type B. A Type A element has well-defined failure modes, fully determinable behaviour under fault, and dependable field data; anything else, typically an element containing a microcontroller or other complex logic, is Type B.

Part 2, Table 2 (Type A):

SFF	HFT 0	HFT 1	HFT 2
< 60 %	SIL 1	SIL 2	SIL 3
60 % to < 90 %	SIL 2	SIL 3	SIL 4
90 % to < 99 %	SIL 3	SIL 4	SIL 4
≥ 99 %	SIL 3	SIL 4	SIL 4

Part 2, Table 3 (Type B):

SFF	HFT 0	HFT 1	HFT 2
< 60 %	Not allowed	SIL 1	SIL 2
60 % to < 90 %	SIL 1	SIL 2	SIL 3
90 % to < 99 %	SIL 2	SIL 3	SIL 4
≥ 99 %	SIL 3	SIL 4	SIL 4

Read on a single channel with no redundancy (HFT 0), a Type B element reaches SIL 1 from 60 % SFF, SIL 2 from 90 %, and SIL 3 only at 99 % or more. Two Type B channels (HFT 1) reach SIL 3 from 90 % SFF. Integrated circuits that claim redundancy inside one chip, such as lockstep cores, have to meet the special requirements of Part 2 Annex E before that internal redundancy can be counted.

Route 2H: minimum HFT with better data

Route 2H was new in Edition 2. It drops the SFF tables and replaces them with minimum HFT values per SIL, on condition that the failure data come from field feedback and are used at a 90 % confidence level, against 70 % for Route 1H. Type B elements used in Route 2H must have a diagnostic coverage of at least 60 %. The 61508 Association paper listed in the sources summarises the minimum HFT values as follows (secondary source, to be checked against Part 2 clause 7.4.4.3):

SIL	Minimum HFT under Route 2H
SIL 1	0
SIL 2, low demand	0
SIL 2, high demand or continuous	1
SIL 3	1
SIL 4	2

The same paper, written in 2015, noted that the draft of the next IEC 61511-1 edition (published in 2016) based its hardware fault tolerance requirements on this Route 2H pattern rather than on the SFF tables.

Architectures and MooN notation

IEC 61508 names voting architectures as M-out-of-N (MooN), with a D suffix when diagnostics act on the outcome. Part 6 Annex B gives probability formulas for 1oo1, 1oo2, 2oo2, 1oo2D, 1oo3 and 2oo3.

1oo1: one channel, HFT 0.
1oo2: two channels, either can perform the safety function, HFT 1; good for safety, more spurious trips.
2oo2: two channels, both must act, HFT 0 for safety; fewer spurious trips, but one dangerous failure prevents the function.
1oo2D: two channels with diagnostics deciding which output is used.
2oo3: three channels, majority vote, HFT 1; balances safety and availability.

Redundancy only pays if the channels do not fail together. Part 6 Annex D gives a method to estimate the common cause factor (beta) from the design measures taken: separation, diversity, analysis, competence and environmental control. The proof test interval, the coverage of the proof test, and the mean repair time are inputs of the Annex B formulas; they belong to the safety manual and to the operating procedures, not only to the calculation sheet.

Software: Part 3 per SIL

Part 3 follows a software safety lifecycle (requirements, architecture, design, coding, module testing, integration, validation, modification, verification). Annex A, normative, lists for each phase the techniques and measures with a recommendation per SIL: HR (highly recommended), R (recommended), NR (not recommended) or no recommendation. Annex B, informative, details them (coding standards, dynamic analysis and testing, static analysis, modelling, semi-formal methods). The team selects a combination and justifies it; a technique marked HR that is not used needs a documented rationale.

Clause 7.4.4 covers support tools: compilers, code generators, test and configuration tools are classified by their possible effect on the executable code, and the evidence asked for grows with that effect. Pre-existing software, including commercial operating systems and libraries, can be used if it meets the Part 3 route for elements not developed to the standard, or if a compliant item with its safety manual is available.

Functional safety management and assessment

Part 1 requires functional safety management: roles and responsibilities, competence of the persons involved, planning, configuration and modification management, and the confirmation measures (verification, functional safety audits, functional safety assessment). The competence requirement is about the role and the application; the standard does not require any named personal certification.

The functional safety assessment is carried out by people independent of the design. Table 5 of Part 1 sets the minimum level of independence for the E/E/PE and software lifecycle phases, from an independent person at SIL 1 to an independent organisation at SIL 4; for SIL 2 and SIL 3, the choice between independent person, department or organisation depends on factors that the notes to the table list, such as lack of previous experience, complexity and novelty of design. Table 4 does the same for the overall lifecycle phases, graded by consequence.

The foreword of each part says that IEC itself does not provide any attestation of conformity. A "SIL certificate" is a certification body statement against its own scheme; its scope, validity and surveillance are set by that scheme, not by IEC 61508.

Compliant items, safety manuals and proven in use

An element sold for safety use is integrated through its safety manual. Part 2 Annex D (hardware) and Part 3 Annex D (software) list what that safety manual for compliant items must contain: the functions, the failure modes and rates, the diagnostics, the constraints on use, the proof test needs, the systematic capability and the evidence of conformity. The integrator imports those figures and constraints; any departure from the stated conditions of use takes the element out of its claim.

Proven in use is a separate route, set by Part 2 clause 7.4.10, to claim systematic capability for an element from its documented operating history in a comparable environment. Part 7 Annex D gives a probabilistic approach for pre-developed software. Both demand a traceable record of use and failures, which most commercial components do not come with.

Sector standards built on IEC 61508

Part 1 says the main objective of the standard is to help sector committees write their own standards. The family below is the one most electronics teams meet.

Sector	Standard and current edition	Relation to IEC 61508	Integrity scale
Process industry	IEC 61511-1:2016 + AMD1:2017	"Process sector implementation of IEC 61508:2010" (IEC record); applies to the safety instrumented system as specified, installed and operated	SIL 1 to 4
Machinery	IEC 62061:2021 + AMD1:2024	"Machinery sector specific standard within the framework of IEC 61508"; excludes the design of complex programmable electronic subsystems	SIL 1 to 3; "maximum SIL" of a subsystem since 2021 (formerly SILCL)
Machinery	ISO 13849-1:2023 (fourth edition)	Parallel route from the EN 954-1 tradition, not derived from IEC 61508	PL a to e
Railway software	EN 50716:2023	Supersedes EN 50128:2011 and EN 50657:2017; date of withdrawal of conflicting national standards 30 October 2026	Software integrity levels
Automotive	ISO 26262:2018	Adaptation of IEC 61508 for road vehicles	ASIL A to D
Medical	IEC 60601 series, ISO 14971, IEC 62304	Outside IEC 61508: Part 1 clause 1.2 n excludes medical equipment in compliance with IEC 60601	IEC 62304 software safety classes A, B, C

Sector standards adapt, they do not copy. An element assessed to IEC 61508 at SIL 3 is not automatically fit for an ASIL D item under ISO 26262, and a logic solver certified to IEC 61508 does not relieve the process plant owner from the IEC 61511 analysis of each safety instrumented function.

IEC 61508 and CE marking

IEC 61508 is not a harmonised standard, and neither is IEC 61511. Under the Machinery Directive 2006/42/EC, the list of harmonised standards is Implementing Decision (EU) 2023/1586, amended by Implementing Decision (EU) 2026/2015 of 4 September 2026. For safety-related control systems it lists:

Harmonised standard	Status in the list on 7 October 2026
EN IEC 62061:2021	Listed (row 104 of Annex I)
EN IEC 62061:2021/A1:2024	Added by Decision (EU) 2026/2015, published on 7 September 2026
EN ISO 13849-1:2015	Listed (row 66 of Annex I); deleted from 15 May 2027 by Decision (EU) 2024/1329
EN ISO 13849-1:2023	Listed (row 66a, inserted by Decision (EU) 2024/1329 of 13 May 2024)
EN 61508 series, EN 61511 series	Not listed

Regulation (EU) 2023/1230 on machinery replaces the Directive from 20 January 2027. No harmonised standards have yet been cited under the Regulation; until they are, the presumption of conformity for safety-related control systems comes from the Directive list above. Under the Directive, EN ISO 13849-1:2023 has been cited since May 2024 (Decision (EU) 2024/1329), and the 2015 edition loses its presumption on 15 May 2027.

For a product with a safety function, the CE file therefore cites the sector harmonised standard for presumption, and uses the IEC 61508 work (element assessments, safety manuals, calculations) as the technical evidence behind it. See the CE page, the harmonised standards and the machinery legislation page.

Claims the texts contradict

Claim	What the texts say
"IEC 61508 is maintained by SC 65A working group WG 14"	The Part 1 foreword and every catalogue record name TC 65/SC 65A "System aspects"; the records name no working group.
"No schedule is public for Edition 3"	On 7 October 2026 the IEC web store shows Edition 3.0 of all seven parts at stage PRVC, forecast for 22 October 2026 (Part 6: 21 November 2026).
"IEC 62061 rates subsystems with a SIL CL (SIL claim limit)"	The IEC 62061:2021 record lists among the changes a "shift from SILCL to maximum SIL of a subsystem".
"IEC 62061 and ISO 13849 give presumption of conformity under Regulation (EU) 2023/1230"	No standard is cited under the Regulation yet. Under Directive 2006/42/EC, EN IEC 62061:2021 (with A1:2024) and EN ISO 13849-1:2023 are cited, the 2015 edition until 15 May 2027.
"EN 61511 gives presumption of conformity for process equipment"	EN 61511 is not in the machinery list, and IEC 61511 applies to the safety instrumented system of a plant, not to a product placed on the market.
"IEC 60601-1 is a medical derivative of IEC 61508"	Part 1 clause 1.2 n: IEC 61508 does not apply to medical equipment in compliance with the IEC 60601 series.
"EN 50128 and EN 50657 are the railway software standards"	EN 50716:2023 supersedes both; conflicting national standards must be withdrawn by 30 October 2026.
"SIL 3 requires an independent organisation as assessor"	Part 1 Table 5 requires an independent organisation at SIL 4; at SIL 3 an independent department or organisation, depending on factors such as novelty and complexity.
"A single Type B channel is limited to SIL 1 or SIL 2"	Part 2 Table 3 allows SIL 3 at HFT 0 when SFF is 99 % or more.
"Route 2H drops any diagnostic requirement"	Type B elements under Route 2H need a diagnostic coverage of at least 60 %, and the data must reach a 90 % confidence level.
"An IEC 61508 certificate is valid for 3 to 5 years"	IEC issues no certificate and the standard sets no validity period; certificate terms belong to each certification body scheme.
"LOPA is codified by IEC 61511 only"	IEC 61508-5 Annex F also describes a semi-quantitative method using LOPA (informative).

Pitfalls observed in projects

Component SIL confused with function SIL: a "SIL 3 capable" element does not make a SIL 3 function; the whole chain must meet the target, the architecture constraints and the systematic capability.
Safety manual not applied: diagnostic intervals, proof tests, environmental limits and configuration rules in the safety manual are conditions of the claim, not advice.
Proof test assumptions the operator cannot meet: the interval and coverage used in the PFD_avg calculation must match the real maintenance plan.
SIL allocated without a traceable risk analysis: the SIL comes from the risk reduction needed, documented with a method such as those in Part 5 or IEC 61511-3.
Sector standard skipped: an IEC 61508 assessment of a supplier does not replace the ISO 26262 or IEC 61511 work of the integrator.
Edition drift: Edition 3 is close; check which edition a customer contract, a certificate or a sector standard cites before planning a gap analysis.

Frequently asked questions

What is the role of IEC 61508?: IEC 61508 is the generic international standard for the functional safety of electrical, electronic and programmable electronic (E/E/PE) safety-related systems. It is prepared by sub-committee SC 65A (System aspects) of IEC technical committee TC 65. Part 1 states two objectives: to facilitate the writing of product and sector standards, and to allow E/E/PE safety-related systems to be developed where no sector standard exists. It sets the safety integrity levels (SIL 1 to 4), their target failure measures, the overall safety lifecycle, and the requirements against both random hardware failures and systematic failures, including software. IEC 61511 (process) and IEC 62061 (machinery) describe themselves as sector implementations within its framework.
Which edition of IEC 61508 is currently applicable?: Edition 2.0, published on 30 April 2010 for all seven parts, is the current edition. It replaced the first edition, published between December 1998 and May 2000. On 7 October 2026 the IEC web store shows Edition 3.0 of every part at stage PRVC (the vote on the committee draft for vote has closed and its report is being prepared), with forecast publication dates of 22 October 2026 for Parts 1 to 5 and 7, and 21 November 2026 for Part 6. Forecast dates are targets, not commitments; until Edition 3 is actually published, Edition 2 is the one to cite.
How is the SIL of a safety function determined?: The SIL is set per safety function, from a hazard and risk analysis, as the risk reduction that the E/E/PE system must deliver. IEC 61508 does not mandate a method: Part 1 says it provides a risk-based framework and example techniques, and leaves the SIL values for sector applications to sector standards. Part 5 gives informative examples: a quantitative method (Annex D), risk graphs (Annex E), layer of protection analysis, LOPA (Annex F), and a qualitative hazardous event severity matrix (Annex G).
What is the difference between PFD_avg and PFH?: In low demand mode (demands on the safety function no more frequent than once per year), the target is the average probability of dangerous failure on demand, PFD_avg (Part 1, Table 2). In high demand or continuous mode, the target is the average frequency of dangerous failure per hour, PFH (Part 1, Table 3). Each SIL is one decade wide. Part 1 also sets a floor for a single E/E/PE safety-related system: a PFD_avg of 10^-5 in low demand mode and a PFH of 10^-9 per hour in high demand or continuous mode.
What do HFT, SFF, Route 1H and Route 2H mean?: HFT (hardware fault tolerance) is N when N+1 faults can cause loss of the safety function. SFF (safe failure fraction) is the share of failures that are safe or detected dangerous. Under Route 1H, Part 2 Tables 2 and 3 give the maximum SIL allowed for a Type A or Type B element from its HFT and SFF. Route 2H replaces the SFF tables by minimum HFT values per SIL, but only with field reliability data at a higher confidence level (90 %) and, for Type B elements, a diagnostic coverage of at least 60 %.
Do IEC 61511 and IEC 62061 replace IEC 61508 in their sector?: For the system they cover, yes. IEC 61511-1:2016 describes itself as a process sector implementation of IEC 61508:2010 and addresses the specification, design, installation, operation and maintenance of a safety instrumented system. IEC 62061:2021 is a machinery sector standard within the IEC 61508 framework, but it excludes the design of complex programmable electronic subsystems, which therefore stays under IEC 61508. In practice the logic solver, transmitter or safety chip is developed under IEC 61508 and then used by the integrator under the sector standard.
What does "SIL 3 capable" on a datasheet mean?: It is a claim about an element, not a safety function. It usually means the element meets the Route 1H or 2H constraints and the systematic capability needed for use in a SIL 3 safety function, under the conditions written in its safety manual. Part 2 Annex D (and Part 3 Annex D for software) lists what that safety manual for compliant items must contain. The integrator still has to show that the whole function (sensors, logic, final elements) meets the PFD_avg or PFH target and the architectural constraints, and that the manual conditions are respected.
Who assesses an IEC 61508 project, and is there an official certificate?: Part 1 requires a functional safety assessment by people independent of the design. Table 5 sets the minimum independence for the E/E/PE and software phases: from an independent person at SIL 1 to an independent organisation at SIL 4, with SIL 2 and SIL 3 depending on factors such as novelty, complexity and previous experience. There is no IEC certificate: the foreword of each part states that IEC itself does not provide any attestation of conformity, which is left to independent certification bodies.