EN IEC 61508: The Universal Foundation of Functional Safety

EN IEC 61508 – universal foundation of functional safety serves as a cornerstone for various industry-specific safety standards. It outlines principles for minimizing risks in systems based on electrical, electronic, or programmable technology (E/E/PE). The standard is built upon four key pillars:

1. Safety Lifecycle
   – from initial concept and hazard analysis to system decommissioning.
2. Safety Integrity Levels (SIL)
   – assigned to safety functions to determine reliability requirements.
3. Functional Safety Management
   – clearly defined roles, responsibilities, verification procedures, and competence reviews.
4. Documentation
   – creation, maintenance, and updating of all relevant data and reports for operation and potential audits.

These principles make 61508 applicable across various sectors, from machinery and railways to aviation, energy (including nuclear), and process automation.

Application Across Industries

Machinery and Production Lines: EN 62061 and EN ISO 13849

In the context of machine design and production lines, we often refer to:

• EN 62061 – “Safety of machinery – Functional safety of electrical, electronic and programmable electronic control systems for machinery,”
• EN ISO 13849-1 – describing “Performance Level” (PL).

Both standards heavily draw from 61508 concepts, especially in risk assessment, safety integrity level determination, and redundancy principles.

Practical Examples:

• Automated Packaging Line: uses light curtains and emergency stops, designed so that breaking the beam results in an immediate and safe machine halt.
• Collaborative Robots (Cobots): additional requirements for human contact response, often considering SIL 2 or SIL 3.

61508 provides the overarching methodology, while 62061/13849-1 specify step-by-step risk analysis and safety function implementation in machinery.

Railway Industry: EN 5012x Series

In the railway sector, standards include:

• EN 50126 (RAMS – Reliability, Availability, Maintainability, Safety),
• EN 50128 (railway software),
• EN 50129 (electronic systems in railway signaling).

Each standard, in terms of safety requirements, aligns with fundamental rules similar to 61508, including SIL levels (typically 0–4) and stringent requirements for system independence (channel redundancy) and disturbance resistance (common cause failures).

Example:

• Train Traffic Control: in case of collision threat, brakes activate automatically. If marked as SIL 4, the system must meet extremely strict reliability standards and testing procedures, per EN 50128/50129.

Process Industry: EN 61511

For chemical plants, petrochemicals, refineries, or gas processing facilities, we refer to PN-EN 61511 – derived directly from 61508 but focused specifically on SIS (Safety Instrumented Systems).

• Design safety loops (SIF – Safety Instrumented Function), determine SIL for each.
• Often use the HAZOP method in process hazard analysis.
• Ensure sensors and actuators have appropriate reliability and are tested regularly.

Nuclear Energy: IEC 61513

When failure risks pose threats to large areas (nuclear power plants), functional safety standards become even stricter.

• IEC 61513 (sometimes referred to in Poland as PN-IEC 61513) describes requirements for protective and control systems of nuclear blocks.
• Multi-channel redundancy is required (e.g., 2oo3, 2oo4 – “two out of three,” etc.) and very stringent software design control.

Aviation: DO-178C / DO-254

While 61508 is not directly used in aviation, the concept aligns. Documents DO-178C (for onboard software) and DO-254 (for hardware) introduce criticality levels A–E, based on error consequences (from minor inconveniences to aircraft catastrophe). The methodology of analysis, redundancy, testing, and configuration management is essentially very similar to 61508, with an emphasis on detailed avionics certification rules.

EN IEC 61508: Principles and Practical Significance

1. Safety Lifecycle
   • Includes phases: from concept definition, through detailed design (hardware, software), to installation, commissioning, operation, and modifications.
   • This approach ensures that safety is analyzed and confirmed throughout the entire operational period, not just at the end of a project.
2. Safety Integrity Levels (SIL)
   • There are four levels: SIL 1 – least stringent; SIL 4 – most stringent.
   • Each defines acceptable limits for the probability of dangerous failure (e.g., PFD for low demand mode).
3. Risk Assessment and Documentation
   • Before designing, you must know what hazards exist and their scale.
   • Documentation (analyses like HAZOP, FMEA, fault tree) forms the system’s backbone – in case of an audit, you can demonstrate the rationality of your design decisions.
4. Independence and Redundancy
   • Redundancy is effective only if two (or more) channels do not fail simultaneously for the same reason (common cause failures).
   • High SIL often requires different technologies, different power supplies, etc.
5. Competence Management
   • People responsible for designing and maintaining safety systems must have the qualifications and experience (the standard explicitly emphasizes this).

Benefits of Using PN-EN 61508

1. Fewer Failures and Downtime – through better risk control and early defect detection.
2. Regulatory Compliance – clients, inspectors, and insurers often require certification according to such standards.
3. Increased Trust – systems designed according to 61508 / 61511 / 62061 / EN 5012x are perceived as more reliable.
4. Long-term Efficiency – although implementation can be costly, it reduces potential losses from accidents or legal issues.

EN IEC 61508: Common Mistakes and Pitfalls

1. Lack of Proper Common Cause Failure Analysis: a redundant system can fail if channels share a common power source or data bus.
2. Relying on a Single SIL-Certified Component: having a sensor or controller with a SIL 2/3 certificate does not automatically mean the entire system achieves that level – comprehensive architecture matters (sensors, cabling, software, actuators).
3. Lack of Periodic Testing: for systems operating infrequently, testing in real conditions is mandatory. Without this, there’s no certainty that a safety function will work in a critical moment.
4. Neglecting the Modification Phase: if you change even a fragment of software or replace a valve, you must repeat some safety lifecycle steps – especially impact analysis.
5. Neglecting Competence: from designers to maintenance staff – everyone needs proper training to know how to adhere to functional safety principles.

PN-EN 61508 serves as a starting point, while sector-specific standards (PN-EN 61511, 62061, EN 5012x, IEC 61513, DO-178C/254, etc.) adapt its principles to the specifics of individual industries. For you, as a designer or user of safety systems, this means:

• Clear and consistent guidelines on how to approach risk analysis, SIL determination, or system testing.
• Need for creating detailed documentation – from test protocols to records of personnel competencies.
• Greater assurance that implemented solutions meet international standards and will be acceptable to clients and regulatory bodies.

Ultimately, while it may be a costly and time-consuming process, correctly implementing PN-EN 61508 (or its “derivatives”) translates to lower accident risks, more stable plant operation, and better industry reputation. These standards are not merely “unnecessary paperwork” but effective tools for protecting life, health, and property.

FAQ: EN IEC 61508