Part VI — Safety: IEC 61508 (Industrial / SIL)¶

GUIDE · PART VI — IEC 61508

Disclaimer

Syscribe is a modeling and documentation tool provided "as-is" without warranty of any kind. The authors and contributors accept no responsibility or liability for the use of this tool in safety-critical, life-critical, or mission-critical applications.

Output from Syscribe — including validation results, generated templates, traceability reports, and analysis artifacts — must be independently reviewed and verified by qualified engineers before use in any certification, regulatory submission, or safety case. Compliance with standards such as ISO 26262, IEC 61508, ISO 13849-1, ISO/SAE 21434, IEC 61025, DO-178C, or any other functional safety or cybersecurity standard remains the sole responsibility of the user and their organisation.

This tool does not replace a certified safety process, a qualified safety engineer, or a formal assessment body.

IEC 61508 and ISO 26262 share the same syscribe element types. The differences are in the risk parameters, the integrity level field, the metric gating rules, and some terminology.

6.1 Key differences from ISO 26262¶

Aspect	ISO 26262	IEC 61508
Integrity level field	`asilLevel: A–D`	`silLevel: 1–4`
HazardousEvent risk params	`severity`, `exposure`, `controllability`	`consequence`, `freqExposure`, `avoidance`, `demandRate`
Top-level metric gate	PMHF < 1e-8/h (ASIL D) + SPFM + LFM	PFH < 1e-8/h (SIL 4 high demand) — SPFM/LFM are informational
W033 metric gate	Fires for SPFM, LFM, or PMHF miss	Fires only for PFH/PFDavg/PMHF miss; SPFM/LFM shown but not gated
W039 confirmation-measure check (opt-in: dormant until a `ConfirmationMeasure` exists)	ASIL D goal/requirement needs an I3 `functional_safety_assessment`	SIL 3 or SIL 4 goal/requirement needs an I3 `functional_safety_assessment`
Tool qualification reference	ISO 26262-8 §11	IEC 61508-3 Annex D

6.2 IEC 61508 risk graph parameters¶

---
type: HazardousEvent
id: HE-KERNEL-001
name: "Kernel scheduler starvation — industrial control loop misses deadline"
status: approved
consequence: Cc          # Ca · Cb · Cc · Cd  (Cd = catastrophic)
freqExposure: Fb         # Fa (rare) · Fb (frequent)
avoidance: Pa            # Pa (possible) · Pb (barely possible)
demandRate: W2           # W1 · W2 · W3
---

syscribe records the risk-graph parameters but does not derive a SIL from them: the SIL determination (IEC 61508-5 risk graph) is the analyst's, and its result is set as silLevel: on the SafetyGoal (§6.3) — not on the HazardousEvent. syscribe does not cross-check the SafetyGoal's silLevel against the HazardousEvent's parameters; record the risk-graph reasoning in the HazardousEvent body for review.

6.3 SafetyGoal for SIL¶

---
type: SafetyGoal
id: SG-CTRL-001
name: "Controller shall not miss safety deadline"
status: approved
silLevel: 4
safeState: "Controlled shutdown via ESD circuit"
ftti: "200 ms — bounded by the ESD circuit response time"
hazardousEvents:
  - Safety::HE-KERNEL-001
---

6.4 Metric gating for SIL 4¶

For SIL 4 high-demand mode, the PFH target is < 1e-8/h. syscribe's metrics command computes PFH from the FaultTreeEvent failureRate and diagnosticCoverage fields using the IEC 61508-2 §7.4 formula (equivalent to PMHF for continuous/high-demand mode).

syscribe -m model metrics

W033 fires only if the PMHF/PFH target is missed (for a demand-mode goal, target: {mode: demand, ...}, the PFDavg limit: SIL 1-4 = 1e-1, 1e-2, 1e-3, 1e-4; a rate-only or PFDavg figure gates only when the goal declares target: or .syscribe.toml sets [reliability.targets.sil.<n>], otherwise its fail is advisory; metrics exits 2 on a gating failure, see syscribe help metrics). SPFM and LFM values appear in the output for engineering insight but do not trigger W033 for SIL goals (they are ASIL-D targets from ISO 26262-5 §9). This means a SIL 4 goal can show SPFM=0.79 (below the ASIL-D target of 0.99) and still PASS — because the SIL 4 standard gates PFH, not SPFM.

Practical implication: if you are writing a dual-standard product (SIL 4 for IEC 61508 and targeting ASIL D for ISO 26262 simultaneously), use asilLevel: D and you will be gated on all three metrics.

6.5 Tool qualification (IEC 61508-3 Annex D)¶

IEC 61508-3 Annex D classifies tools by their potential to introduce errors: - T1: output checked by another means (low qualification burden) - T2: can affect program but is detectable - T3: affects the output and errors may not be detectable

syscribe generates documentation and runs model analysis. It does not produce code that runs on the safety-critical target. Its role is T1 — the outputs (requirements documents, traceability matrices, metrics reports) are reviewed by engineers before use. Document this classification in your tool qualification plan.

Your compiler (rustc, gcc-arm, etc.) is T3 and requires Annex D qualification or use of a pre-qualified compiler (e.g., Ferrocene for Rust).