Are Your Diagnostics Really Part of the Safety Function?

My topic for this blog is whether some 'diagnostics' are not really diagnostics but rather part of the safety function. This is important for calculating the Average frequency of dangerous failure (PFH), Safe Failure Fraction (SFF), Diagnostic Safe Failure Fraction (DSFF), and diagnostic test interval.

IEC 61508 revision 3 FDIS is expected to be open for voting shortly (June 2026) if it is not already open. One of the most interesting changes is the requirements for diagnostics given in IEC 61508-2 7.4.12, including that diagnostics should have an SC (systematic capability) of at least one less than the SC of the safety function, and, in my cases, have a DSFF.

Since Analog Devices (ADI) acquired Linear Technology, power supply monitors have become a subject very close to my heart. So, let’s use power supply monitors to explore the topic.

Figure 1: A typical circuit showing a power supply monitor

For functional safety, windowed power supply monitors are generally preferred. A windowed power supply monitor monitors for under-voltage and over-voltage. This is important because if the circuits implementing the safety functionality are rated to run with supplies of 3.3V +/-10%, then all performance and functional guarantees are void if the supply falls to 2.99V or 3.61V because those devices are then operating outside of their specifications.  Believe it or not, this isn’t explicitly stated in IEC 61508, but is indirectly covered by the de-rating clause in part 2.

Figure 2: Derating requirements from IEC 61508-2:2010

Let’s explore how this monitored power supply fails:

•  Power supply fails, high–power supply monitor detects it and puts the system in a safe state
•  Power supply fails low – power supply monitor detects it and puts the system in a safe state

The monitor certainly looks like a diagnostic. But let’s continue the thought experiment. Let’s see how the system operates in its normal state with no failures.

Figure 3: AD7124 AVDD operating voltage range and monitor trip points 

To start, the system is set up, and somebody switches it on. The supply voltage rises from 0V to 3.3V, and at 3.0V, the power supply monitor de-asserts the safe state, and the system operates as expected. Up to 3.3V, the monitor is asserting the safe state even though there is no failure in the power supply. Zero volts and the ramp from 0 to 3 volts is just the normal operating condition; there is no failure. If something is needed to make the safety function work in normal operating conditions, then it is not a diagnostic; it is part of the safety function.

Figure 4: A power supply voltage ramping

So, a low voltage is very different from a high voltage. You need a failure to get the high voltage, and you get a low voltage when powering on.

Figure 5: Earlier graphic changed to show what represents a failure and what does not

Ok, so if the power supply monitor is really part of the safety function, what are the implications? The implications include:

• The SC of the monitor needs to be the same as the SC of the rest of the safety function
• Dangerous, undetected failures of the monitor contribute directly to the PFH/PFD of the safety function
• You need to consider at least diagnostics on the under-voltage detect, and the effectiveness of those diagnostics contributes to the SFF of the safety function, rather than to a DSFF (new term in IEC 61508 version 3 related to diagnostics on your diagnostics)
• For IEC 61508 revision 3, the diagnostics on the under-voltage detect may need their own diagnostics due to DSFF requirements in IEC 61508 revision 3

Solutions might include a pull-down on the monitor's under-voltage input, which can be exercised at regular intervals. The interval could be extended by having redundant monitors, perhaps once per year for SIL 2 or once per month for SIL 3.

A SIL 3-compliant monitor, such as the MAX42500, will avoid some of these issues. Even IEC 61508 revision 3 allows the use of on-chip diagnostics to detect on-chip failures for a compliant item.

Other functions, which may or may not be diagnostics, include:

• ECC – at least the error correction portion would seem to be part of the safety function
• The defenses in an SCL (safety communication layer) for communications according to IEC 61784-3

This blog is already too long to discuss them. This is the first blog where I think I have mentioned requirements from IEC 61508 revision 3, due out in late 2026 or early 2027, provided there is a successful FDIS vote. If the FDIS is accepted, I will cover IEC 61508 revision 3 changes in upcoming blogs.

Assuming you made it to the end of this blog, I invite you to check back next month on the second Tuesday for the next blog in this series. Until then, I hope to post “mini blogs” on the other Tuesdays in the month directly from my LinkedIn account. Please follow me on LinkedIn if interested.

This blog concentrated on the functional safety of power. If you are a fan of functional safety for power, my colleagues at ADI have published a lot of material on power supply monitors. See their articles entitled “Improving industrial functional safety compliance with high performance supervisory circuits.”

• Part 1 - Improving Industrial Functional Safety Compliance with High Performance Supervisory Circuits
• Part 2 - Using SIL-Rated Components
• Part 3 - Safety Critical features
• Part 4 - Program Sequence Monitoring using Watchdog Timer
• Part 5 - Sequencers Eliminate Systematic Failures

There are also two articles on the topic of “Designing power supplies for industrial functional safety,” Part 1 and  Part 2, which will be coming soon.

Related Blogs

1. The Ideal Power Supply Monitor

2. Functional Safety for Power

For previous blogs in this series, see here.

For the full suite of ADI blogs on the EngineerZone platform, see here.

For the full range of ADI products, see here.