IEC 61508 is an international standard of rules applied in industry.
It is titled Functional Safety of ElectricalProgrammable Electronic Safety-related Systems.
IEC 61508 is intended to be a basic functional safety standard applicable to all kinds of
industry.
It defines functional safety as: “part of the overall safety relating to the EUC and
the EUC control system which depends on the correct functioning of the EPE safety-related
systems, other technology safety-related systems and external risk reduction facilities.”
The standard covers the complete safety life cycle, and may need interpretation to develop
sector specific standards.
It has its origins in the process control industry.
The safety life cycle has 16 phases which roughly can be divided into three groups as
follows: Phases 1-5 address analysis
Phases 6-13 address realisation Phases 14-16 address operation.
All phases are concerned with the safety function of the system.
The standard has seven parts: Parts 1-3 contain the requirements of the
standard Parts 4-7 are guidelines and examples for
development and thus informative.
Central to the standard are the concepts of risk and safety function.
The risk is a function of frequency of the hazardous event and the event consequence
severity.
The risk is reduced to a tolerable level by applying safety functions which may consist
of EPES and/or other technologies.
While other technologies may be employed in reducing the risk, only those safety functions
relying on EPES are covered by the detailed requirements of IEC 61508.
IEC 61508 has the following views on risks: Zero risk can never be reached
Safety must be considered from the beginning Non-tolerable risks must be reduced
Hazard and Risk Analysis The standard requires that hazard and risk
assessment should be carried out: 'The EUC risk shall be evaluated, or estimated, for
each determined hazardous event'.
The standard advises that 'Either qualitative or quantitative hazard and risk analysis techniques
may be used' and offers guidance on a number of approaches.
One of these, for the qualitative analysis of hazards, is a framework based on 6 categories
of likelihood of occurrence and 4 of consequence.
Categories of likelihood of occurrence Consequence categories
These are typically combined into a risk class matrix
Where: Class I: Unacceptable in any circumstance;
Class II: Undesirable: tolerable only if risk reduction is impracticable or if the costs
are grossly disproportionate to the improvement gained;
Class III: Tolerable if the cost of risk reduction would exceed the improvement;
Class IV: Acceptable as it stands, though it may need to be monitored.
Safety integrity level The safety integrity level provides a target
to attain in regards to a system's development.
A risk assessment effort yields a target SIL, which thus becomes a requirement for the final
system.
The requirement informs how to set up the development process so that one can reasonably
justify that the final system attains the required SIL.
Part 2 and 3 of IEC 61508 give guidance on activities to perform to for attaining a SIL
level.
Improved reliability The meaning of the SIL varies depending on
whether the functional component will be exposed to high or low demand:
For systems that operate continuously or systems that operate more than once per year, SIL
specifies an allowable frequency of dangerous failure.
For systems that operate intermittently and at most once a year, SIL specifies an allowable
probability that the system will fail to respond on demand.
Failure to safety Calculation of safe failure fraction determines
how Fail-safe the system is.
This compares the likelihood of safe failures with dangerous failures.
Reliability by itself is not sufficient to claim a SIL level.
There are charts in IEC 61508 that specify the level of SFF required for each SIL.
Management, systematic techniques, verification and validation
Specific techniques ensure that mistakes and errors are avoided across the entire life-cycle.
Errors introduced anywhere from the initial concept, risk analysis, specification, design,
installation, maintenance and through to disposal could undermine even the most reliable protection.
IEC 61508 specifies techniques that should be used for each phase of the life-cycle.
Industry/application specific variants Automotive software
The development of software for safety related automotive systems is predominantly covered
by the Motor Industry Software Reliability Association guidelines.
The MISRA project was conceived to develop guidelines for the creation of embedded software
in road vehicle electronic systems.
In November 1994 Development a set of guidelines for vehicle based software were published.
This document provides the first automotive industry interpretation of the principles
of the, then emerging, IEC 61508 standard.
ISO 26262 is an adaptation of IEC 61508 for Automotive Electric/Electronic Systems.
Rail software IEC 62279 provides a specific interpretation
of IEC 61508 for railway applications.
It is intended to cover the development of software for railway control and protection
including communications, signaling and processing systems.
Process industries The process industry sector includes many
types of manufacturing processes, such as refineries, petrochemical, chemical, pharmaceutical,
pulp and paper, and power.
IEC 61511 is a technical standard which sets out practices in the engineering of systems
that ensure the safety of an industrial process through the use of instrumentation.
Nuclear power plants IEC 61513 provides requirements and recommendations
for the instrumentation and control for systems important to safety of nuclear power plants.
It indicates the general requirements for systems that contain conventional hardwired
equipment, computer-based equipment or a combination of both types of equipment.
Machinery IEC 62061 is the machinery-specific implementation
of IEC 61508.
It provides requirements that are applicable to the system level design of all types of
machinery safety-related electrical control systems and also for the design of non-complex
subsystems or devices.
Testing software Software written in accordance with IEC 61508
may need to be unit tested, depending up on the SIL level it needs to achieve.
The main requirement in Unit Testing is to ensure that the software is fully tested at
the function level and that all possible branches and paths are taken through the software.
In some higher SIL level applications, the software code coverage requirement is much
tougher and an MCDC coverage criteria is used rather than simple branch coverage.
See topic on MCDC code coverage.
To obtain the MCDC coverage information, one will need a Unit Testing tool, sometimes referred
to as a Software Module Testing tool.
See also Functional Safety
Safety standards Spurious trip level
Time-triggered system References
External links 61508 Association
IEC Functional safety zone Inside Functional Safety - Technical magazine
focusing on functional safety CFSE Governance Board website
[1] - Motor Industry Software Reliability Association
Papers A revised proposal for IEC 61508.
This paper was presented at the Embedded Systems Show 2006 in Birmingham, UK.
An article about meeting the IEC 61508 part 3 requirements for tool certification, specially
compilers.
Open IEC 61508 Certification of Products - This paper describes an assessment for product
designs and the product development process that produces a full safety case as well as
additional public documentation.
Satisfying SIL Requirements: Ensure Functional Safety of EPE Safety-Related Systems
Textbooks M.J.M.
Houtermans, "SIL and Functional Safety in a Nutshell" SIL and Functional Safery in a
Nutshell - eBook introducing SIL and Functional Safety
M.Medoff, R.Faller, "Functional Safety - An IEC 61508 SIL 3 Compliant Development Process"
- www.exida.com C. O'Brien, "Final Elements and the IEC 61508
and IEC 61511 Functional Safety Standards" - www.exida.com
Münch, Jürgen; Armbrust, Ove; Soto, Martín; Kowalczyk, Martin.
“Software Process Definition and Management“, Springer, 2012.
M.Punch, "Functional Safety for the Mining Industry – An Integrated Approach Using
AS(IEC)61508, AS(IEC) 62061 and AS4024.1.".
www.marcuspunch.com D.Smith, K Simpson, "Safety Critical Systems
Handbook: A Straightforward Guide to Functional Safety, IEC 61508 And Related Standards, Including
Process IEC 61511 and Machinery IEC 62061 and ISO 13849".