IEC 61508:2010 — Functional Safety of E/E/PE Safety-Related Systems — Compliance Brief
Record covered: robotics-cert-016 Issuing body: International Electrotechnical Commission (IEC), Subcommittee 65A (System aspects). Jurisdiction: International — the umbrella ("basic safety publication" per IEC Guide 104) from which sector functional-safety standards descend: IEC 61511 (process industry), ISO 26262 (automotive), IEC 62061 and ISO 13849 (machinery), IEC 61131-6 (PLCs), IEC 61800-5-2 (drives). Status: IEC 61508:2010 (Edition 2) is the current published edition. Edition 3 is in draft — committee drafts at CDV stage circulated in 2025 (prEN IEC 61508-1:2025) — but not published as of September 2026 (verified via draft-status listings).
1. What it is
IEC 61508 is the foundational standard for functional safety: the engineering discipline that gives confidence an electrical/electronic/programmable-electronic (E/E/PE) system will perform its safety function when demanded — the emergency stop that must stop, the safety-rated speed monitor that must trip. "Functional" distinguishes it from passive safety (guards, insulation): it is about active safety behavior. The standard defines the full safety lifecycle (concept → hazard and risk analysis → requirements → design → verification → operation → decommissioning) and the management of both random hardware failures and systematic failures (design errors — the dominant cause of safety-system failure).
2. Scope — who and what it applies to
Anyone developing, integrating, or assessing E/E/PE safety-related systems: safety PLC and safety controller vendors (robot safety controllers are TÜV-certified against it — e.g. x86-based robot safety controllers, Siemens SIMATIC Safety rated to SIL 3 per IEC 61508:2010, per TÜV/Siemens publications), machinery builders implementing safety functions, and process-industry SIS designers. Sector standards (13849/62061 for machinery) are usually the direct compliance route for machinery; 61508 is the parent that defines the concepts and is invoked directly for novel or cross-sector systems.
3. Key requirements and compliance obligations
- Safety lifecycle: a phase-gated process from hazard and risk analysis through safety requirements specification, design, verification, installation/commissioning, operation, maintenance, and modification/decommissioning — with verification at every phase and functional-safety assessment by parties independent of the designers (independence level scales with SIL).
- Safety Integrity Levels (SIL 1–4): the risk-reduction target. Low-demand mode: probability of dangerous failure on demand (e.g. SIL 3: 10⁻⁴ to 10⁻³); high-demand/continuous mode: dangerous failures per hour (SIL 3: 10⁻⁸ to 10⁻⁷). SIL 4 is reserved for the most critical applications and is rarely claimed outside rail/nuclear.
- Two failure classes, two requirement families: random hardware integrity (architectural constraints, diagnostic coverage, hardware fault tolerance) and systematic integrity (rigorous development process, techniques and measures tables scaled by SIL — the higher the SIL, the more mandatory the formal methods, diverse redundancy, and independent review).
- Seven parts: 61508-1 (general requirements), -2 (E/E/PE hardware), -3 (software), -4 (definitions), -5 (SIL determination methods), -6 (application guidelines), -7 (techniques and measures overview).
- Software (Part 3): lifecycle, coding standards, verification techniques, and tool qualification scaled by SIL — the part most robotics software teams actually live in.
4. Penalties / consequences of non-compliance
No fines attach to the standard. Consequences: no certificate, no market — safety components for machinery sold in the EU need the functional-safety evidence chain (usually via 13849/62061, which rest on 61508 concepts) to support CE marking; without credible SIL/PL evidence, integrators won't buy. In incident litigation, the safety lifecycle documentation is the evidence that the manufacturer exercised due care — its absence is the plaintiff's case. Sector regulators (e.g. in process safety, OSHA PSM audits) probe the management-system elements 61508 formalizes.
5. Version and edition status — live changes
- Edition 2 (2010) remains the published, current edition — the basis of the installed base of certificates and the TÜV Functional Safety Engineer curriculum.
- Edition 3 drafts (2025, CDV stage) propose: alignment with the 2024 ISO/IEC Directives (editorial/renumbering), clarified treatment of AI, human factors, and security in hazard and risk analysis, clarified SIL vs. Systematic Capability distinction, and new independence requirements for functional-safety assessment. Not published — do not design to draft text; but organizations starting multi-year safety programs should track it, since AI-in-safety-functions is squarely in its scope.
- The machinery-sector children (ISO 13849, IEC 62061) are themselves being merged into the forthcoming IEC/ISO 17305 — a separate consolidation to watch alongside 61508 Ed. 3.
6. Related certifications
- Robotics — TÜV Rheinland Functional Safety Engineer, Machinery track (robotics-cert-007): the credential that directly tests IEC 61508 (with ISO 13849 & IEC 62061) — the standard is the exam's parent body of knowledge.
- Robotics — A3 Certified Robot Integrator (robotics-cert-001): integrators specify and validate safety functions whose integrity claims trace to 61508 concepts.
7. Flags and honest caveats
- Edition 3 status is verified only to "draft at CDV stage in 2025, unpublished as of Sept 2026" — publication timing was not confirmed; check the IEC webstore before committing.
- 61508 is deliberately generic and demanding; for pure machinery applications, start with ISO 13849 / IEC 62061 (the sector children) and invoke 61508 directly only where those don't reach (complex programmable safety systems, novel architectures).
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.