EN 61508-4:2001

6/29(16., 6,67(1

67$1'$5'
MDQXDU
)XQNFLMVNDYDUQRVWHOHNWULþQLKHOHNWURQVNLKSURJUDPLUOMLYLKHOHNWURQVNLK
YDUQRVWQLKVLVWHPRYGHO'HILQLFLMHLQNUDWLFH,(&
SRSUDYHN
LVWRYHWHQ(1
)XQFWLRQDOVDIHW\RIHOHFWULFDOHOHFWURQLFSURJUDPPDEOHHOHFWURQLFVDIHW\UHODWHG
V\VWHPV3DUW'HILQLWLRQVDQGDEEUHYLDWLRQV,(&&RUULJHQGXP

,&6 5HIHUHQþQDãWHYLOND

6,67(1HQ
!"#$%&’( )&!*+,%- .
EUROPEAN STANDARD EN 61508-4
NORME EUROPÉENNE
EUROPÄISCHE NORM December 2001
ICS 25.040.40;29.020
English version
Functional safety of electrical/electronic/programmable electronic
safety-related systems
Part 4: Definitions and abbreviations
(IEC 61508-4:1998 + corrigendum 1999)
Sécurité fonctionnelle des systèmes Funktionale Sicherheit
électriques/électroniques/électroniques sicherheitsbezogener elektrischer/
programmables relatifs à la sécurité elektronischer/programmierbarer
Partie 4: Définitions et abréviations elektronischer Systeme
(CEI 61508-4:1998 + corrigendum 1999) Teil 4: Begriffe und Abkürzungen
(IEC 61508-4:1998 + Corrigendum 1999)
This European Standard was approved by CENELEC on 2001-07-03. CENELEC members are bound to
comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on
application to the Central Secretariat or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other
language made by translation under the responsibility of a CENELEC member into its own language and
notified to the Central Secretariat has the same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Czech Republic,
Denmark, Finland, France, Germany, Greece, Iceland, Ireland, Italy, Luxembourg, Malta, Netherlands,
Norway, Portugal, Spain, Sweden, Switzerland and United Kingdom.
CENELEC
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
Central Secretariat: rue de Stassart 35, B - 1050 Brussels
© 2001 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members.
Ref. No. EN 61508-4:2001 E
Foreword
The text of the International Standard IEC 61508-4:1998 including its corrigendum April 1999,
prepared by SC 65A, System aspects, of IEC TC 65, Industrial-process measurement and control,
was submitted to the Unique Acceptance Procedure and was approved by CENELEC as EN 61508-4
on 2001-07-03 without any modification.
The following dates were fixed:
– latest date by which the EN has to be implemented
at national level by publication of an identical
national standard or by endorsement (dop) 2002-08-01
– latest date by which the national standards conflicting
with the EN have to be withdrawn (dow) 2004-08-01
Annexes designated "normative" are part of the body of the standard.
Annexes designated "informative" are given for information only.
In this standard, annex ZA is normative and annex A is informative.
Annex ZA has been added by CENELEC.
IEC 61508 is a basic safety publication covering the functional safety of electrical, electronic and
programmable electronic safety-related systems. The scope states:
"This International Standard covers those aspects to be considered when electrical/electronic/
programmable electronic systems (E/E/PESs) are used to carry out safety functions. A major objective
of this standard is to facilitate the development of application sector international standards by the
technical committees responsible for the application sector. This will allow all the relevant factors
associated with the application, to be fully taken into account and thereby meet the specific needs of
the application sector. A dual objective of this standard is to enable the development of
electrical/electronic/ programmable electronic (E/E/PE) safety-related systems where application
sector international standards may not exist".
The CENELEC Report R0BT-004, ratified by 103 BT (March 2000) accepts that some IEC standards,
which today are either published or under development, are sector implementations of IEC 61508. For
example:
� IEC 61511, Functional safety - Safety instrumented systems for the process industry sector;
� IEC 62061, Safety of machinery – Functional safety of electrical, electronic and programmable
electronic control systems;
� IEC 61513, Nuclear power plants – Instrumentation and control for systems important to safety –
General requirements for systems.
The railways sector has also developed a set of European Standards (EN 50126; EN 50128 and
prEN 50129).
NOTE  EN 50126 and EN 50128 were based on earlier drafts of IEC 61508. prEN 50129 is based on the principles of the
latest version of IEC 61508.
This list does not preclude other sector implementations of IEC 61508 which could be currently under
development or published within IEC or CENELEC.
__________
- 3 - EN 61508-4:2001
Endorsement notice
The text of the International Standard IEC 61508-4:1998 including its corrigendum April 1999 was
approved by CENELEC as a European Standard without any modification.
In the official version, for Bibliography, the following note has to be added for the standard indicated:
IEC 61131-3:1993 NOTE  Harmonized as EN 61131-3:1993 (not modified).
ISO 9000-3:1991 NOTE  Harmonized as EN 29000-3:1993 (not modified).
__________
Annex ZA
(normative)
Normative references to international publications
with their corresponding European publications
This European Standard incorporates by dated or undated reference, provisions from other
publications. These normative references are cited at the appropriate places in the text and the
publications are listed hereafter. For dated references, subsequent amendments to or revisions of any
of these publications apply to this European Standard only when incorporated in it by amendment or
revision. For undated references the latest edition of the publication referred to applies (including
amendments).
NOTE When an international publication has been modified by common modifications, indicated by (mod), the relevant
EN/HD applies.
Publication Year Title EN/HD Year
IEC 60050-191 1990 International Electrotechnical --
Vocabulary (IEV) -- Chapter 191:
Dependability and quality of service
IEC 60050-351 1975 Chapter 351: Automatic control - -
IEC 61508-1 1998 Functional safety of EN 61508-1 2001
+ corr. May 1999 electrical/electronic/programmable
electronic safety-related systems
Part 1: General requirements
IEC 61508-2 2000 Part 2: Requirements for EN 61508-2 2001
electrical/electronic/programmable
electronic safety-related systems
IEC 61508-3 1998 Part 3: Software requirements EN 61508-3 2001
+ corr. April 1999
IEC 61508-5 1998 Part 5: Examples of methods for the EN 61508-5 2001
+ corr. April 1999 determination of safety integrity levels
IEC 61508-6 2000 Part 6: Guidelines on the application of EN 61508-6 2001
IEC 61508-2 and IEC 61508-3
IEC 61508-7 2000 Part 7: Overview of techniques and EN 61508-7 2001
measures
IEC Guide 104 1997 The preparation of safety publications--
and the use of basic safety publications
and group safety publications
ISO/IEC 2382-14 1998 Data processing - Vocabulary --
Part 14: Reliability, maintainability and
availability
ISO/IEC Guide 51 1990 Guidelines for the inclusion of safety--
aspects in standards
ISO 8402 1994 Quality management and quality EN ISO 8402 1995
assurance - Vocabulary
INTERNATIONAL IEC
STANDARD
61508-4
First edition
1998-12
BASIC SAFETY PUBLICATION
Functional safety of electrical/electronic/
programmable electronic safety-related systems –
Part 4:
Definitions and abbreviations
 IEC 1998 Copyright - all rights reserved
No part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical,
including photocopying and microfilm, without permission in writing from the publisher.
International Electrotechnical Commission, 3, rue de Varembé, PO Box 131, CH-1211 Geneva 20, Switzerland
Telephone: +41 22 919 02 11 Telefax: +41 22 919 03 00 E-mail: inmail@iec.ch  Web: www.iec.ch
PRICE CODE
U
Commission Electrotechnique Internationale
International Electrotechnical Commission
Международная Электротехническая Комиссия
For price, see current catalogue

61508-4 © IEC:1998 – 3 –
CONTENTS
Page
FOREWORD . 5
INTRODUCTION . 9
Clause
1 Scope. 13
2 Normative references. 17
3 Definitions and abbreviations. 19
3.1 Safety terms. 19
3.2 Equipment and devices . 21
3.3 Systems: general aspects . 25
3.4 Systems: safety-related aspects . 29
3.5 Safety functions and safety integrity . 31
3.6 Fault, failure and error. 37
3.7 Lifecycle activities. 41
3.8 Confirmation of safety measures . 43
Annex A (informative) Bibliography . 49
Index. 51
Figures
1 Overall framework of this standard . 15
2 Programmable electronic system (PES): structure and terminology. 27
3 Electrical/electronic/programmable electronic system (E/E/PES):
structure and terminology . 27
4 Failure model . 39
Table
1 Abbreviations used in this standard . 19

61508-4 © IEC:1998 – 5 –
INTERNATIONAL ELECTROTECHNICAL COMMISSION
_________
FUNCTIONAL SAFETY OF ELECTRICAL/ELECTRONIC/PROGRAMMABLE
ELECTRONIC SAFETY-RELATED SYSTEMS –
Part 4: Definitions and abbreviations
FOREWORD
1) The IEC (International Electrotechnical Commission) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of the IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, the IEC publishes International Standards. Their preparation is
entrusted to technical committees; any IEC National Committee interested in the subject dealt with may
participate in this preparatory work. International, governmental and non-governmental organizations liaising
with the IEC also participate in this preparation. The IEC collaborates closely with the International Organization
for Standardization (ISO) in accordance with conditions determined by agreement between the two
organizations.
2) The formal decisions or agreements of the IEC on technical matters express, as nearly as possible, an
international consensus of opinion on the relevant subjects since each technical committee has representation
from all interested National Committees.
3) The documents produced have the form of recommendations for international use and are published in the form
of standards, technical reports or guides and they are accepted by the National Committees in that sense.
4) In order to promote international unification, IEC National Committees undertake to apply IEC International
Standards transparently to the maximum extent possible in their national and regional standards. Any
divergence between the IEC Standard and the corresponding national or regional standard shall be clearly
indicated in the latter.
5) The IEC provides no marking procedure to indicate its approval and cannot be rendered responsible for any
equipment declared to be in conformity with one of its standards.
6) Attention is drawn to the possibility that some of the elements of this International Standard may be the subject
of patent rights. The IEC shall not be held responsible for identifying any or all such patent rights.
International Standard IEC 61508-4 has been prepared by subcommittee 65A: System aspects,
of IEC technical committee 65: Industrial-process measurement and control.
The text of this standard is based on the following documents:
FDIS Report on voting
65A/265/FDIS 65A/275/RVD
Full information on the voting for the approval of this standard can be found in the report on
voting indicated in the above table.
Annex A is for information only.

61508-4 © IEC:1998 – 7 –
IEC 61508 consists of the following parts, under the general title Functional safety of elec-
trical/electronic/programmable electronic safety-related systems:
– Part 1: General requirements
– Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems
– Part 3: Software requirements
– Part 4: Definitions and abbreviations
– Part 5: Examples of methods for the determination of safety integrity levels
– Part 6: Guidelines on the application of parts 2 and 3
– Part 7: Overview of techniques and measures
This part 4 shall be read in conjunction with all other parts.
It has the status of a basic safety publication in accordance with IEC Guide 104.
The contents of the corrigendum of April 1999 have been included in this copy.

61508-4 © IEC:1998 – 9 –
INTRODUCTION
Systems comprised of electrical and/or electronic components have been used for many years
to perform safety functions in most application sectors. Computer-based systems (generically
referred to as programmable electronic systems (PESs)) are being used in all application
sectors to perform non-safety functions and, increasingly, to perform safety functions. If
computer system technology is to be effectively and safely exploited, it is essential that those
responsible for making decisions have sufficient guidance on the safety aspects on which to
make those decisions.
This International Standard sets out a generic approach for all safety lifecycle activities for
systems comprised of electrical and/or electronic and/or programmable electronic components
(electrical/electronic/ programmable electronic systems (E/E/PESs)) that are used to perform
safety functions. This unified approach has been adopted in order that a rational and consistent
technical policy be developed for all electrically based safety-related systems. A major
objective is to facilitate the development of application sector standards.
In most situations, safety is achieved by a number of protective systems which rely on many
technologies (for example mechanical, hydraulic, pneumatic, electrical, electronic,
programmable electronic). Any safety strategy must therefore consider not only all the
elements within an individual system (for example sensors, controlling devices and actuators)
but also all the safety-related systems making up the total combination of safety-related
systems. Therefore, while this International Standard is concerned with electrical/elec-
tronic/programmable electronic (E/E/PE) safety-related systems, it may also provide a
framework within which safety-related systems based on other technologies may be
considered.
It is recognised that there is a great variety of E/E/PES applications in a variety of application
sectors and covering a wide range of complexity, hazard and risk potentials. In any particular
application, the required safety measures will be dependent on many factors specific to the
application. This International Standard, by being generic, will enable such measures to be
formulated in future application sector international standards.
This International Standard
– considers all relevant overall, E/E/PES and software safety lifecycle phases (for example,
from initial concept, through design, implementation, operation and maintenance to
decommissioning) when E/E/PESs are used to perform safety functions;
– has been conceived with a rapidly developing technology in mind; the framework is
sufficiently robust and comprehensive to cater for future developments;
– enables application sector international standards, dealing with safety-related E/E/PESs, to
be developed; the development of application sector international standards, within the
framework of this International Standard, should lead to a high level of consistency (for
example, of underlying principles, terminology, etc.) both within application sectors and
across application sectors; this will have both safety and economic benefits;
– provides a method for the development of the safety requirements specification necessary
to achieve the required functional safety for E/E/PE safety-related systems;

61508-4 © IEC:1998 – 11 –
– uses safety integrity levels for specifying the target level of safety integrity for the safety
functions to be implemented by the E/E/PE safety-related systems;
– adopts a risk-based approach for the determination of the safety integrity level
requirements;
– sets numerical target failure measures for E/E/PE safety-related systems which are linked
to the safety integrity levels;
– sets a lower limit on the target failure measures, in a dangerous mode of failure, that can
be claimed for a single E/E/PE safety-related system; for E/E/PE safety-related systems
operating in
– a low demand mode of operation, the lower limit is set at an average probability of
-5
failure of 10 to perform its design function on demand,
– a high demand or continuous mode of operation, the lower limit is set at a probability of
–9
a dangerous failure of 10 per hour;
NOTE – A single E/E/PE safety-related system does not necessarily mean a single-channel architecture.
– adopts a broad range of principles, techniques and measures to achieve functional safety
for E/E/PE safety-related systems, but does not use the concept of fail safe which may be
of value when the failure modes are well defined and the level of complexity is relatively
low; the concept of fail safe was considered inappropriate because of the full range of
complexity of E/E/PE safety-related systems that are within the scope of the standard.

61508-4 © IEC:1998 – 13 –
FUNCTIONAL SAFETY OF ELECTRICAL/ELECTRONIC/PROGRAMMABLE
ELECTRONIC SAFETY-RELATED SYSTEMS –
Part 4: Definitions and abbreviations
1 Scope
1.1 This part of IEC 61508 contains the definitions and explanation of terms that are used in
parts 1 to 7 of this standard.
1.2 The definitions are grouped under general headings so that related terms can be
understood within the context of each other. But it should be noted that these headings are not
intended to add meaning to the definitions, and in this sense the headings should be
disregarded.
1.3 Parts 1, 2, 3 and 4 of this standard are basic safety publications, although this status does
not apply in the context of low complexity E/E/PE safety-related systems (see 3.4.4 of part 4).
As basic safety publications, they are intended for use by technical committees in the
preparation of standards in accordance with the principles contained in IEC Guide 104 and
ISO/IEC Guide 51. Parts 1, 2, 3, and 4 are also intended for use as stand-alone publications.
One of the responsibilities of a technical committee is, wherever applicable, to make use of
basic safety publications in the preparation of its publications. In this context, the requirements,
test methods or test conditions of this basic safety publication will not apply unless specifically
referred to or included in the publications prepared by those technical committees.
1.4 Figure 1 shows the overall framework for parts 1 to 7 of IEC 61508 and indicates the role
that IEC 61508-4 plays in the achievement of functional safety for E/E/PE safety-related
systems.
NOTE – In the USA and Canada, until the proposed process sector implementation of IEC 61508 (i.e. IEC 61511) is
published as an international standard in the USA and Canada, existing national process safety standards based on
IEC 61508 (i.e. ANSI/ISA S84.01-1996) can be applied to the process sector instead of IEC 61508.

61508-4 © IEC:1998 – 15 –
Technical
requirements
PART 1
Development of the overall safety
requirements (concept, scope
definition, hazard and risk analysis)
(E/E/PE safety-related systems, other
PART 5
technology safety-related systems and
Risk based approaches
external risk reduction facilities)
to the development of
7.1 to 7.5
the safety integrity
requirements
Other
PART 1
requirements
Allocation of the safety
requirements to the E/E/PE
safety-related systems
Definitions and
PART 7
7.6
abbreviations
Overview of
techniques
and measures
PART 4
PART 6
Guidelines for the
Documentation
Realisation Realisation
application of
phase for phase for
IEC 61508-2 and Clause 5 and
E/E/PE safety- safety-related
IEC 61508-3 annex A
related systems software
PART 1
PART 2 PART 3
Management of
functional safety
Clause 6
PART 1
PART 1
Installation and commissioning
and safety validation of E/E/PE
Functional safety
safety-related systems
assessment
Clause 8
7.13 and 7.14
PART 1
PART 1
Operation and maintenance,
modification and retrofit,
decommissioning or disposal of
E/E/PE safety-related systems
7.15 to 7.17
IEC  1 656/98
Figure 1 — Overall framework of this standard

61508-4 © IEC:1998 – 17 –
2 Normative references
The following normative documents contain provisions which, through reference in this text,
constitute provisions of this part of IEC 61508. For dated references, subsequent amendments
to, or revisions of, any of these publications do not apply. However, parties to agreements
based on this part of IEC 61508 are encouraged to investigate the possibility of applying the
most recent editions of the normative documents indicated below. For undated references, the
latest edition of the normative document referred to applies. Members of IEC and ISO maintain
registers of currently valid International Standards.
IEC 60050(191):1990, International Electrotechnical Vocabulary (IEV) – Chapter 191:
Dependability and quality of service
IEC 60050(351):1975, International Electrotechnical Vocabulary (IEV) – Chapter 351:
Automatic control
IEC 61508-1:1998, Functional safety of electrical/electronical/programmable electronic safety-
related systems – Part 1: General requirements
IEC 61508-2:—, Functional safety of electrical/electronical/programmable electronic safety-
related systems – Part 2: Requirements for electrical/electronical/programmable electronic
1)
safety-related systems
IEC 61508-3:1998, Functional safety of electrical/electronical/programmable electronic safety-
related systems – Part 3: Software requirements
IEC 61508-5:1998, Functional safety of electrical/electronical/programmable electronic safety-
related systems – Part 5: Examples of methods for the determination of safety integrity levels
IEC 61508-6:—, Functional safety of electrical/electronical/programmable electronic safety-
1)
related systems – Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3
IEC 61508-7:—, Functional safety of electrical/electronical/programmable electronic safety-
1)
related systems – Part 7: Overview of techniques and measures
IEC Guide 104:1997, The preparation of safety publications and the use of basic safety
publications and group safety publications
ISO/IEC 2382-14:1998, Data processing – Vocabulary – Part 14: Reliability, maintainability
and availability
ISO/IEC Guide 51:1990, Safety aspects – Guidelines for their inclusion in standards
ISO 8402:1994, Quality management and quality assurance – Vocabulary
________
1)
To be published.
61508-4 © IEC:1998 – 19 –
3 Definitions and abbreviations
For the purposes of this International Standard, the following definitions and the abbreviations
given in table 1 apply.
Table 1 — Abbreviations used in this standard
Abbreviation Full expression Definition and/or explanation of term
MooN M out of N channel architecture Annex B of IEC 61508-6
(for example 1oo2 is 1 out of 2 architecture, where
either of the two channels can perform the safety
function)
MooND M out of N channel architecture with diagnostics Annex B of IEC 61508-6
ALARP As low as is reasonably practicable Annex B of IEC 61508-5
E/E/PE Electrical/electronic/programmable electronic 3.2.6
E/E/PES Electrical/electronic/programmable electronic 3.3.3
system
EUC Equipment under control 3.2.3
PES Programmable electronic system 3.3.2
PLC Programmable logic controller Annex E of IEC 61508-6
SIL Safety integrity level 3.5.6
3.1 Safety terms
3.1.1
harm
physical injury or damage to the health of people either directly or indirectly as a result of
damage to property or to the environment
[ISO/IEC Guide 51:1990 (modified)]
NOTE – This definition will need to be addressed when carrying out a hazard and risk analysis (see IEC 61508-1, 7.4).
If the scope is to be widened (e.g to include environmental damage which may not give rise to physical injury or
damage to health) then this would need to be addressed in the Overall Scope Definition phase (see IEC 61508-1, 7.3).
3.1.2
hazard
potential source of harm [Guide 51 ISO/IEC:1990]
NOTE – The term includes danger to persons arising within a short time scale (for example, fire and explosion) and
also those that have a long-term effect on a person’s health (for example, release of a toxic substance).
3.1.3
hazardous situation
circumstance in which a person is exposed to hazard(s)
3.1.4
hazardous event
hazardous situation which results in harm
3.1.5
risk
combination of the probability of occurrence of harm and the severity of that harm
[ISO/IEC Guide 51:1990 (modified)]
NOTE – For more discussion on this concept see annex A of IEC 61508-5.
3.1.6
tolerable risk
risk which is accepted in a given context based on the current values of society
NOTE – See annex B of IEC 61508-5.

61508-4 © IEC:1998 – 21 –
3.1.7
residual risk
risk remaining after protective measures have been taken
3.1.8
safety
freedom from unacceptable risk
3.1.9
functional safety
part of the overall safety relating to the EUC and the EUC control system which depends on the
correct functioning of the E/E/PE safety-related systems, other technology safety-related
systems and external risk reduction facilities
3.1.10
safe state
state of the EUC when safety is achieved
NOTE – In going from a potentially hazardous condition to the final safe state, the EUC may have to go through a
number of intermediate safe states. For some situations a safe state exists only so long as the EUC is continuously
controlled. Such continuous control may be for a short or an indefinite period of time.
3.1.11
reasonably foreseeable misuse
use of a product, process or service under conditions or for purposes not intended by the
supplier, but which can happen, induced by the product, process or service in combination with,
or as a result of, common human behaviour
3.2 Equipment and devices
3.2.1
functional unit
entity of hardware or software, or both, capable of accomplishing a specified purpose
NOTE – In IEV 191-01-01 the more general term “item” is used in place of functional unit. An item may sometimes
include people.
[ISO/IEC 2382-14-01-01]
3.2.2
software
intellectual creation comprising the programs, procedures, data, rules and any associated
documentation pertaining to the operation of a data processing system
NOTE 1 – Software is independent of the medium on which it is recorded.
NOTE 2 – This definition without note 1 differs from ISO 2382-1, and the full definition differs from ISO 9000-3, by
the addition of the word data.
3.2.3
equipment under control (EUC)
equipment, machinery, apparatus or plant used for manufacturing, process, transportation,
medical or other activities
NOTE – The EUC control system is separate and distinct from the EUC.

61508-4 © IEC:1998 – 23 –
3.2.4
EUC risk
risk arising from the EUC or its interaction with the EUC control system
NOTE 1 – The risk in this context is that associated with the specific hazardous event in which E/E/PE safety-
related systems, other technology safety-related systems and external risk reduction facilities are to be used to
provide the necessary risk reduction, (i.e. the risk associated with functional safety).
NOTE 2 – The EUC risk is indicated in figure A.1 of IEC 61508-5. The main purpose of determining the EUC risk is
to establish a reference point for the risk without taking into account E/E/PE safety-related systems, other
technology safety-related systems and external risk reduction facilities.
NOTE 3 – Assessment of this risk will include associated human factor issues.
3.2.5
programmable electronic (PE)
based on computer technology which may be comprised of hardware, software, and of input
and/or output units
NOTE – This term covers microelectronic devices based on one or more central processing units (CPUs) together
with associated memories, etc.
EXAMPLE The following are all programmable electronic devices:
– microprocessors;
– micro-controllers;
– programmable controllers;
– application specific integrated circuits (ASICs);
– programmable logic controllers (PLCs);
– other computer-based devices (for example smart sensors, transmitters, actuators).
3.2.6
electrical/electronic/programmable electronic (E/E/PE)
based on electrical (E) and/or electronic (E) and/or programmable electronic (PE) technology
NOTE – The term is intended to cover any and all devices or systems operating on electrical principles.
EXAMPLE Electrical/electronic/programmable electronic devices include
– electro-mechanical devices (electrical);
– solid-state non-programmable electronic devices (electronic);
– electronic devices based on computer technology (programmable electronic); see 3.2.5.
3.2.7
limited variability language
software programming language, either textual or graphical, for commercial and industrial
programmable electronic controllers with a range of capabilities limited to their application
EXAMPLE The following are limited variability languages, from IEC 61131-3 and other sources, which are used to
represent the application program for a PLC system:
– ladder diagram: a graphical language consisting of a series of input symbols (representing behaviour similar to
devices such as normally open and normally closed contacts) interconnected by lines (to indicate the flow of
current) to output symbols (representing behaviour similar to relays);
– Boolean algebra: a low-level language based on Boolean operators such as AND, OR and NOT with the ability
to add some mnemonic instructions;
– function block diagram: in addition to Boolean operators, allows the use of more complex functions such as data
transfer file, block transfer read/write, shift register and sequencer instructions;
– sequential function chart: a graphical representation of a sequential program consisting of interconnected steps,
actions and directed links with transition conditions.

61508-4 © IEC:1998 – 25 –
3.3 Systems: general aspects
3.3.1
system
set of elements which interact according to a design, where an element of a system can be
another system, called a subsystem, which may be a controlling system or a controlled system
and may include hardware, software and human interaction
NOTE 1 – A person can be part of a system (see also note 5 of 3.4.1).
NOTE 2 – This definition differs from IEV 351-01-01.
3.3.2
programmable electronic system (PES)
system for control, protection or monitoring based on one or more programmable electronic
devices, including all elements of the system such as power supplies, sensors and other input
devices, data highways and other communication paths, and actuators and other output
devices (see figure 2)
NOTE – The structure of a PES is shown in figure 2 a). Figure 2 b) illustrates the way in which a PES is represent-
ed in this International Standard, with the programmable electronics shown as a unit distinct from sensors and
actuators on the EUC and their interfaces, but the programmable electronics could exist at several places in the
PES. Figure 2 c) illustrates a PES with two discrete units of programmable electronics. Figure 2 d) illustrates a PES
with dual programmable electronics (i.e. two-channel), but with a single sensor and a single actuator.
3.3.3
electrical/electronic/programmable electronic system (E/E/PES)
system for control, protection or monitoring based on one or more electrical/electronic
programmable electronic (E/E/PE) devices, including all elements of the system such as power
supplies, sensors and other input devices, data highways and other communication paths, and
actuators and other output devices (see figure 3)
3.3.4
EUC control system
system which responds to input signals from the process and/or from an operator and
generates output signals causing the EUC to operate in the desired manner
NOTE – The EUC control system includes input devices and final elements.
3.3.5
architecture
specific configuration of hardware and software elements in a system
3.3.6
module
routine, discrete component or a functional set of encapsulated routines or discrete
components belonging together
3.3.7
software module
construct that consists of procedures and/or data declarations and that can also interact with
other such constructs
61508-4 © IEC:1998 – 27 –
Input interfaces Output interfaces
Communications
Extent
A-D converters D-A converters
of PES
Programmable
electronics
(see note)
Input devices Output devices/final elements
(for example sensors) (for example actuators)
a) Basic PES structure
PE
PE
PE PE PE
1 2
PE
b) Single PES with single program- c) Single PES with dual program- d) Single PES with dual program-
mable electronic device (i.e. one PES mable electronic devices linked in a mable electronic devices but with
comprised of a single channel of serial manner (for example intelligent shared sensors and final elements (i.e.
programmable electronics) sensor and programmable controller) one PES comprised of two channels
of programmable electronics)
IEC  1 657/98
NOTE – The programmable electronics are shown centrally located but could exist at several places in the PES.
Figure 2 — Programmable electronic system (PES): structure and terminology
Input interfaces Output interfaces
A-D converters D-A converters
Communications
Extent of
E/E/PES
E/E/PE device
Input devices Output devices/
final elements
(for example sensors)
(for example actuators)
IEC  1 658/98
NOTE – THE E/E/PE device is shown centrally located but such device(s) could exist at several places in the E/E/PES.
Figure 3 — Electrical/electronic/programmable electronic system (E/E/PES):
structure and terminology
61508-4 © IEC:1998 – 29 –
3.3.8
channel
element or group of elements that independently perform(s) a function
EXAMPLE A two-channel (or dual-channel) configuration is one with two channels that independently perform the
same function.
NOTE 1 – The elements within a channel could include input/output modules, a logic system (see 3.4.5), sensors
and final elements.
NOTE 2 – The term can be used to describe a complete system, or a portion of a system (for example, sensors or
final elements).
3.3.9
diversity
different means of performing a required function
EXAMPLE Diversity may be achieved by different physical methods or different design approaches.
3.3.10
redundancy
existence of means, in addition to the means which would be sufficient for a functional unit to
perform a required function or for data to represent information
EXAMPLE Duplicated functional components and the addition of parity bits are both instances of redundancy.
NOTE 1 – Redundancy is used primarily to improve reliability or availability.
NOTE 2 – The definition in IEV 191-15-01 is less complete.
[ISO/IEC 2382-14-01-12]
3.4 Systems: safety-related aspects
3.4.1
safety-related system
designated system that both
– implements the required safety functions necessary to achieve or maintain a safe state for
the EUC; and
– is intended to achieve, on its own or with other E/E/PE safety-related systems, other
technology safety-related systems or external risk reduction facilities, the necessary safety
integrity for the required safety functions
NOTE 1 – The term refers to those systems, designated as safety-related systems, that are intended to achieve,
together with the external risk reduction facilities (see 3.4.3), the necessary risk reduction in order to meet the
required tolerable risk (see 3.1.6). See also annex A of IEC 61508-5.
NOTE 2 – The safety-related systems are designed to prevent the EUC from going into a dangerous state by taking
appropriate action on receipt of commands. The failure of a safety-related system would be included in the events
leading to the determined hazard or hazards. Although there may be other systems having safety functions, it is the
safety-related systems that have been designated to achieve, in their own right, the required tolerable risk. Safety-
related systems can broadly be divided into safety-related control systems and safety-related protection systems,
and have two modes of operation (see 3.5.12).
NOTE 3 – Safety-related systems may be an integral part of the EUC control system or may interface with the EUC
by sensors and/or actuators. That is, the required safety integrity level may be achieved by implementing the safety
functions in the EUC control system (and possibly by additional separate and independent systems as well) or the
safety functions may be implemented by separate and independent systems dedicated to safety.
NOTE 4 – A safety-related system may
a) be designed to prevent the hazardous event (i.e. if the safety-related systems perform their safety functions
then no hazardous event arises);
b) be designed to mitigate the effects of the hazardous event, thereby reducing the risk by reducing the
consequences;
c) be designed to achieve a combination of a) and b).

61508-4 © IEC:1998 – 31 –
NOTE 5 – A person can be part of a safety-related system (see 3.3.1). For example, a person could receive
information from a programmable electronic device and perform a safety action based on this information, or
perform a safety action through a programmable electronic device.
NOTE 6 – The term includes all the hardware, software and supporting services (for example, power supplies)
necessary to carry out the specified safety function (sensors, other input devices, final elements (actuators) and
other output devices are therefore included in the safety-related system).
NOTE 7 – A safety-related system may be based on a wide range of technologies including electrical, electronic,
programmable electronic, hydraulic and pneumatic.
3.4.2
other technology safety-related system
safety-related system based on a technology other than electrical/electronic/programmable
electronic
EXAMPLE A relief valve is another technology safety-related system.
3.4.3
external risk reduction facility
measure to reduce or mitigate the risks which are separate and distinct from, and do not use,
E/E/PE safety-related systems or other technology safety-related systems
EXAMPLE A drain system, a fire wall and a bund are all external risk reduction facilities.
3.4.4
low complexity E/E/PE safety-related system
E/E/PE safety-related system (see 3.2.6 and 3.4.1), in which
– the failure modes of each individual component are well defined;
– the behaviour of the system under fault conditions can be completely determined.
NOTE – Behaviour of the system under fault conditions may be determined by analytical and/or test methods.
EXAMPLE A system comprising one or more limit switches, operating, possibly via interposing electro-mechanical
relays, one or more contactors to de-energise an electric motor is a low-complexity E/E/PE safety-related system.
3.4.5
logic system
portion of a system that performs the function logic but excludes the sensors and final
elements
NOTE – In this standard the following logic systems are used:
– electrical logic systems for electro-mechanical technology;
– electronic logic systems for electronic technology;
– programmable electronic logic systems for programmable electronic systems.
3.5 Safety functions and safety integrity
3.5.1
safety function
function to be implemented by an E/E/PE safety-related system, other technology safety-
related system or external risk reduction facilities, which is intended to achieve or maintain a
safe state for the EUC, in respect of a specific hazardous event (see 3.4.1)
3.5.2
safety integrity
probability of a safety-related system satisfactorily performing the required safety functions
under all the stated conditions within a stated period of time
NOTE 1 – The higher the level of safety integrity of the safety-related systems, the lower the probability that the
safety-related systems will fail to carry out the required safety functions.
NOTE 2 – There are four levels of safety integrity for systems (see 3.5.6).

61508-4 © IEC:1998 – 33 –
NOTE 3 – In determining safety integrity, all causes of failures (both random hardware failures and systematic
failures) which lead to an unsafe state should be included, for example hardware failures, software induced failures
and failures due to electrical interference. Some of these types of failure, in particular random hardware failures,
may be quantified using such measures as the failure rate in the dangerous mode of failure or the probability of a
safety-related protection system failing to operate on demand. However, the safety integrity of a system also
depends on many factors which cannot be accurately quantified but can only be considered qualitatively.
NOTE 4 – Safety integrity comprises hardware safety integrity (see 3.5.5) and systematic safety integrity (see
3.5.4).
NOTE 5 – This definition focuses on the reliability of the safety-related systems to perform the safety functions (see
IEV 191-12-01 for a definition of reliability).
3.5.3
software safety integrity
measure that signifies the likelihood of software in a programmable electronic system
achieving its safety functions under all stated conditions within a stated period of time
3.5.4
systematic safety integrity
part of the safety integrity of safety-related systems relating to systematic failures (see note 3
of 3.5.2) in a dangerous mode of failure
NOTE 1 – Systematic safety integrity cannot usually be quantified (as distinct from hardware safety integrity which
usually can).
NOTE 2 – See 3.5.2, 3.5.5 and 3.6.6.
3.5.5
hardware safety integrity
part of the safety integrity
...