IEC 61508
Encyclopedia
IEC 61508 is an international standard
of rules applied in industry. It is titled "Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems".
IEC 61508 is intended to be a basic functional safety standard applicable to all kinds of industry. It defines functional safety as: “part of the overall safety relating to the EUC (Equipment Under Control) and the EUC control system which depends on the correct functioning of the E/E/PE safety-related systems, other technology safety-related systems and external risk reduction facilities.”
The standard covers the complete safety life cycle
, and may need interpretation to develop sector specific standards. It has its origins in the process control industry sector.
The safety life cycle has 16 phases which roughly can be divided into three groups as follows:
All phases are concerned with the safety function of the system.
The standard has seven parts:
Central to the standard are the concepts of risk and safety function. The risk is a function of frequency (or likelihood) of the hazardous event and the event consequence severity. The risk is reduced to a tolerable level by applying safety functions which may consist of E/E/PES and/or other technologies. While other technologies may be employed in reducing the risk, only those safety functions relying on E/E/PES are covered by the detailed requirements of IEC 61508.
IEC 61508 has the following views on risks:
The standard advises that 'Either qualitative or quantitative hazard and risk analysis techniques may be used' and offers guidance on a number of approaches. One of these, for the qualitative analysis of hazards, is a framework based on 6 categories of likelihood of occurrence and 4 of consequence.
Categories of likelihood of occurrence
Consequence categories
These are typically combined into a risk class matrix
Where:
1) Improved reliability.
2) Failure to safety.
3) Management, Systematic Techniques, Verification and Validation.
SIL refers to a single method of reducing injury (as determined through risk analysis), not an entire system, nor an individual component.
the system is. This compares the likelihood of safe failures with dangerous failures. Reliability by itself is not sufficient to claim a SIL level. There are charts in IEC61508 that specify the level of SFF required for each SIL.
is a technical standard which sets out practices in the engineering of systems that ensure the safety of an industrial process through the use of instrumentation.
. To obtain the MCDC (modified condition decision coverage) coverage information you will need a Unit Testing tool, sometime referred top as a Software Module Testing tool.
C. O'Brien, "Final Elements and the IEC 61508 and IEC 61511 Functional Safety Standards" - www.exida.com
M.Punch, "Functional Safety for the Mining Industry – An Integrated Approach Using AS(IEC)61508, AS(IEC) 62061 and AS4024.1." (1st Edition, ISBN 978-0-9807660-0-4, in A4 paperback, 150 pages). www.marcuspunch.com
D.Smith, K Simpson, "Safety Critical Systems Handbook: A Straightforward Guide to Functional Safety, IEC 61508 (2010 Edition) And Related Standards, Including Process IEC 61511 and Machinery IEC 62061 and ISO 13849" (3rd Edition ISBN 978-0080967813, Hardcover, 288 Pages).
International standard
International standards are standards developed by international standards organizations. International standards are available for consideration and use, worldwide...
of rules applied in industry. It is titled "Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems".
IEC 61508 is intended to be a basic functional safety standard applicable to all kinds of industry. It defines functional safety as: “part of the overall safety relating to the EUC (Equipment Under Control) and the EUC control system which depends on the correct functioning of the E/E/PE safety-related systems, other technology safety-related systems and external risk reduction facilities.”
The standard covers the complete safety life cycle
Safety life cycle
The safety life cycle is the series of phases from initiation and specifications of safety requirements, covering design and development of safety features in a safety-critical system, and ending in decommissioning of that system....
, and may need interpretation to develop sector specific standards. It has its origins in the process control industry sector.
The safety life cycle has 16 phases which roughly can be divided into three groups as follows:
- Phases 1-5 address analysis
- Phases 6-13 address realisation
- Phases 14-16 address operation.
All phases are concerned with the safety function of the system.
The standard has seven parts:
- Parts 1-3 contain the requirements of the standard (normative)
- Parts 4-7 are guidelines and examples for development and thus informative.
Central to the standard are the concepts of risk and safety function. The risk is a function of frequency (or likelihood) of the hazardous event and the event consequence severity. The risk is reduced to a tolerable level by applying safety functions which may consist of E/E/PES and/or other technologies. While other technologies may be employed in reducing the risk, only those safety functions relying on E/E/PES are covered by the detailed requirements of IEC 61508.
IEC 61508 has the following views on risks:
- Zero risk can never be reached
- Safety must be considered from the beginning
- Non-tolerable risks must be reduced (ALARPALARPALARP stands for "as low as reasonably practicable", and is a term often used in the milieu of safety-critical and safety-involved systems. The ALARP principle is that the residual risk shall be as low as reasonably practicable...
)
Hazard and Risk Analysis
The standard requires that hazard and risk assessment should be carried out: 'The EUC (equipment under control) risk shall be evaluated, or estimated, for each determined hazardous event'.The standard advises that 'Either qualitative or quantitative hazard and risk analysis techniques may be used' and offers guidance on a number of approaches. One of these, for the qualitative analysis of hazards, is a framework based on 6 categories of likelihood of occurrence and 4 of consequence.
Categories of likelihood of occurrence
| Category | Definition | Range (failures per year) |
|---|---|---|
| Frequent | Many times in system lifetime | > 10-3 |
| Probable | Several times in system lifetime | 10-3 to 10-4 |
| Occasional | Once in system lifetime | 10-4 to 10-5 |
| Remote | Unlikely in system lifetime | 10-5 to 10-6 |
| Improbable | Very unlikely to occur | 10-6 to 10-7 |
| Incredible | Cannot believe that it could occur | < 10-7 |
Consequence categories
| Category | Definition |
|---|---|
| Catastrophic | Multiple loss of life |
| Critical | Loss of a single life |
| Marginal | Major injuries to one or more persons |
| Negligible | Minor injuries at worst |
These are typically combined into a risk class matrix
| Consequence | ||||
| Likelihood | Catastrophic | Critical | Marginal | Negligible |
| Frequent | I | I | I | II |
| Probable | I | I | II | III |
| Occasional | I | II | III | III |
| Remote | II | III | III | IV |
| Improbable | III | III | IV | IV |
| Incredible | IV | IV | IV | IV |
Where:
- Class I: Unacceptable in any circumstance;
- Class II: Undesirable: tolerable only if risk reduction is impracticable or if the costs are grossly disproportionate to the improvement gained;
- Class III: Tolerable if the cost of risk reduction would exceed the improvement;
- Class IV: Acceptable as it stands, though it may need to be monitored.
Safety Integrity Level
The Safety Integrity Level is determined primarily from the assessment of three factors. Higher level Safety Integrity Levels require greater compliance in all three areas.1) Improved reliability.
2) Failure to safety.
3) Management, Systematic Techniques, Verification and Validation.
SIL refers to a single method of reducing injury (as determined through risk analysis), not an entire system, nor an individual component.
1 Improved Reliability
For systems that operate continuously (continuous mode) the allowable frequency of failure must be determined. For systems that operate more than once a year (high demand) the allowable frequency of failure must be determined. For systems that operate intermittently (less than once a year / low demand) the probability of failure is specified as the probability that the system will fail to respond on demand.| SIL | Low demand mode: average probability of failure on demand |
High demand or continuous mode: probability of dangerous failure per hour |
| 1 | ≥ 10-2 to < 10-1 | ≥ 10-6 to < 10-5 |
| 2 | ≥ 10-3 to < 10-2 | ≥ 10-7 to < 10-6 |
| 3 | ≥ 10-4 to < 10-3 | ≥ 10-8 to < 10-7 |
| 4 | ≥ 10-5 to < 10-4 | ≥ 10-9 to < 10-8 |
2 Failure to Safety
Calculation of safe failure fraction (SFF) determines how Fail-safeFail-safe
A fail-safe or fail-secure device is one that, in the event of failure, responds in a way that will cause no harm, or at least a minimum of harm, to other devices or danger to personnel....
the system is. This compares the likelihood of safe failures with dangerous failures. Reliability by itself is not sufficient to claim a SIL level. There are charts in IEC61508 that specify the level of SFF required for each SIL.
3 Management,Systematic Techniques, Verification and Validation
Specific techniques ensure that mistakes and errors are avoided across the entire life-cycle. Errors introduced anywhere from the initial concept, risk analysis, specification, design, installation, maintenance and through to disposal could undermine even the most reliable protection. IEC61508 specifies techniques that should be used for each phase of the life-cycle.Automotive Software
The development of software for safety related automotive systems is predominantly covered by the Motor Industry Software Reliability Association guidelines.. The MISRA project was conceived to develop guidelines for the creation of embedded software in road vehicle electronic systems. In November 1994 Development a set of guidelines for vehicle based software were published. This document provides the first automotive industry interpretation of the principles of the, then emerging, IEC 61508 standard.Rail Software
EN 50128 provides a specific interpretation of IEC 61508 for railway applications. It is intended to cover the development of software for railway control and protection including communications, signaling and processing systems.Process Industries
The process industry sector includes many types of manufacturing processes, such as refineries, petrochemical, chemical, pharmaceutical, pulp and paper, and power. IEC 61511IEC 61511
IEC 61511 is a technical standard which sets out practices in the engineering of systems that ensure the safety of an industrial process through the use of instrumentation. Such systems are referred to as Safety Instrumented Systems...
is a technical standard which sets out practices in the engineering of systems that ensure the safety of an industrial process through the use of instrumentation.
Nuclear power plants
IEC 61513 provides requirements and recommendations for the instrumentation and control for systems important to safety of nuclear power plants. It indicates the general requirements for systems that contain conventional hardwired equipment, computer-based equipment or a combination of both types of equipment.Machinery
IEC 62061 is the machinery specific implementation of IEC 61508. It provides requirements that are applicable to the system level design of all types of machinery safety-related electrical control systems and also for the design of non-complex subsystems or devices.Testing Software To IEC 61508
Software written in accordance with IEC 61508, may need to be Unit Tested, depending up on the SIL level it needs to achieve. The main requirement in Unit Testing is to ensure that the software is fully tested at the function level and that all possible branches and paths are taken through the software. In some higher SIL level aplications the software code coverage requirement is much tougher and an MCDC coverage criteria is used rather than simple branch coverage. See topic on MCDC code coverageCode coverage
Code coverage is a measure used in software testing. It describes the degree to which the source code of a program has been tested. It is a form of testing that inspects the code directly and is therefore a form of white box testing....
. To obtain the MCDC (modified condition decision coverage) coverage information you will need a Unit Testing tool, sometime referred top as a Software Module Testing tool.
See also
- Functional SafetyFunctional SafetyFunctional Safety is the part of the overall safety of a system or piece of equipment that depends on the system or equipment operating correctly in response to its inputs, including the safe management of likely operator errors, hardware failures and environmental changes.- Objective of Functional...
- Safety standardsSafety standardsSafety standards are standards designed to ensure the safety of products, activities or processes, etc. They may be advisory or compulsory and are normally laid down by an advisory or regulatory body that may be either voluntary or statutory...
- Spurious Trip LevelSpurious trip levelSpurious Trip Level is defined as a discrete level for specifying the spurious trip requirements of safety functions to be allocated to safety systems. An STL of 1 means that this safety function has the highest level of spurious trips. The higher the STL level the lower the number of spurious...
- Certified Functional Safety Expert (CFSE)Certified Functional Safety Expert (CFSE)Certified Functional Safety Expert is an independent Functional Safety certification governed by the not-for-profit[1] CFSE Governance Board...
External links
- 61508 Association
- IEC Functional safety zone
- Inside Functional Safety - Technical magazine focusing on functional safety
- CFSE Governance Board website
- http://www.misra.org.uk/MISRAHome/tabid/55/Default.aspx - Motor Industry Software Reliability Association
Papers
- A revised proposal for IEC 61508. This paper was presented at the Embedded Systems Show 2006 in Birmingham, UK.
- An article about meeting the IEC 61508 part 3 (software development) requirements for tool certification, specially compilers.
- Open IEC 61508 Certification of Products - This paper describes an assessment for product designs and the product development process that produces a full safety case as well as additional public documentation.
- Satisfying SIL Requirements: Ensure Functional Safety of E/E/PE Safety-Related Systems (from Parasoft)
Textbooks
M.Medoff, R.Faller, "Functional Safety - An IEC 61508 SIL 3 Compliant Development Process" - www.exida.comC. O'Brien, "Final Elements and the IEC 61508 and IEC 61511 Functional Safety Standards" - www.exida.com
M.Punch, "Functional Safety for the Mining Industry – An Integrated Approach Using AS(IEC)61508, AS(IEC) 62061 and AS4024.1." (1st Edition, ISBN 978-0-9807660-0-4, in A4 paperback, 150 pages). www.marcuspunch.com
D.Smith, K Simpson, "Safety Critical Systems Handbook: A Straightforward Guide to Functional Safety, IEC 61508 (2010 Edition) And Related Standards, Including Process IEC 61511 and Machinery IEC 62061 and ISO 13849" (3rd Edition ISBN 978-0080967813, Hardcover, 288 Pages).