Prelims.qxd 5/22/04 10:00 Page i Functional Safety A Straightforward Guide to applying IEC 61508 and Related Standards This page intentionally left blank Prelims.qxd 5/22/04 10:00 Page iii Functional Safety A Straightforward Guide to applying IEC 61508 and Related Standards Second edition David J Smith BSc, PhD, CEng, FIEE, FIQA, HonFSaRS, MIGasE Kenneth G L Simpson MPhil, FIEE, FInstMC, MIGasE AMSTERDAM • BOSTON • HEIDELBERG • LONDON • NEW YORK • OXFORD PARIS • SAN DIEGO • SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Prelims.qxd 5/22/04 10:00 Page iv Elsevier Butterworth-Heinemann Linacre House,Jordan Hill,Oxford OX2 8DP 200 Wheeler Road,Burlington,MA 01803 First published 2001 Second edition 2004 Copyright © 2001,2004,David J Smith and Kenneth G L Simpson All rights reserved. The right of David J Smith and Kenneth G L Simpson to be identified as the authors of this work has been asserted in accordance with the Copyright, Designs and Patents Act 1988 No part of this publication may be reproduced in any material form (including photocopying or storing in any medium by electronic means and whether or not transiently or incidentally to some other use of this publication) without the written permission of the copyright holder except in accordance with the provisions of the Copyright,Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd,90 Tottenham Court Road,London,England W1T 4LP.Applications for the copyright holder’s written permission to reproduce any part of this publication should be addressed to the publisher Permissions may be sought directly from Elsevier’s Science & Technology Rights Department in Oxford,UK:phone:((cid:2)44) 1865 843830,fax:((cid:2)44) 1865 853333, e-mail:[email protected] may also complete your request on-line via the Elsevier homepage (http://www.elsevier.com),by selecting ‘Customer Support’ and then ‘Obtaining Permissions’ British Library Cataloguing in Publication Data A catalogue record for this book is available from the British Library Library of Congress Cataloguing in Publication Data A catalogue record for this book is available from the Library of Congress ISBN 0 7506 6269 7 For information on all Elsevier Butterworth-Heinemann publications visit our website at http://books.elsevier.com Printed and bound in Great Britain Prelims.qxd 5/22/04 10:00 Page v Contents A Quick Overview ix Acknowledgements xi Part A The Concept of Safety-Integrity 1 The meaning and context of Safety-Integrity targets 3 1.1 Risk and the need for safety targets 3 1.2 Quantitative and qualitative safety targets 7 1.3 The life-cycle approach 11 1.4 Basic steps in the assessment process 14 1.5 Costs 16 1.6 The seven parts of IEC 61508 17 Part B The Basic Requirements of IEC 61508 and 61511 2 Meeting IEC 61508 Part 1 25 2.1 Functional safety management and competence 25 2.2 Establishing SIL targets 30 2.3 Applying ALARP 38 3 Meeting IEC 61508 Part 2 42 3.1 Organising and managing the life-cycle 43 3.2 Requirements involving the specification 44 3.3 Requirements for design and development 46 3.4 Integration and test 52 3.5 Operations and maintenance 52 3.6 Validation 53 3.7 Modifications 53 3.8 Acquired sub-systems 54 3.9 ‘Proven in use’ 54 3.10 Presenting the results 55 Conformance Demonstration Template 55 Prelims.qxd 5/22/04 10:00 Page vi vi Contents 4 Meeting IEC 61508 Part 3 61 4.1 Organising and managing the software engineering 62 4.2 Requirements involving the specification 65 4.3 Requirements for design and development 65 4.4 Integration and test 67 4.5 Validation 68 4.6 Modifications 69 4.7 Some technical comments 69 4.8 ‘Proven in use’ 73 4.9 Presenting the results 74 Conformance Demonstration Template 74 5 Meeting IEC 61511 80 5.1 Organising and managing the life-cycle 81 5.2 Requirements involving the specification 83 5.3 Requirements for design and development 84 5.4 Integration and test 87 5.5 Validation 88 5.6 Modifications 88 5.7 Installation and commissioning 88 5.8 Operations and maintenance 89 5.9 Presenting the results 89 Part C The Quantitative Assessment 6 Reliability modelling techniques 93 6.1 Failure rate and unavailability 93 6.2 Creating a reliability model 94 6.3 Taking account of auto-test 104 6.4 Human error/human factors 107 7 Failure rate and mode data 112 7.1 Data accuracy 112 7.2 Sources of data 115 7.3 Data ranges and confidence levels 118 7.4 Conclusions 120 Part D Related Issues 8 Some comments on Part 6 of IEC 61508 125 8.1 Overview 125 8.2 The quantitative tables (Annex B) 126 8.3 The software safety-integrity tables (Annex E) 131 9 Second tier and related guidance documents 132 9.1 IEC 61511 (Process) 132 Prelims.qxd 5/22/04 10:00 Page vii Contents vii 9.2 IGEM SR/15 133 9.3 UKOOA (Offshore) 133 9.4 ISA S84.01 (Instrumentation) 136 9.5 OLF-077 (Norwegian) 137 9.6 EN 50126 (Railways) 137 9.7 UK MOD (Defence) 140 9.8 MISRA guidelines (Motor) 142 9.9 MISRA C Code guidelines 142 9.10 IEC 61513 (Nuclear) 143 9.11 EEMUA guidelines 145 9.12 RTCA DO-178B (Civil air) 146 9.13 DIN V Standards 146 9.14 Documents related to machinery 147 9.15 NPL Software guidelines 148 9.16 SEMSPLC (Programmable controllers) 149 9.17 Q124 Demonstration guidelines 150 10 Demonstrating and certifying conformance 151 10.1 Demonstrating conformance 151 10.2 The current framework for certification 152 10.3 Self-certification 154 10.4 Other types of ‘certification’ 157 10.5 Preparing for assessment 158 10.6 Summary 159 Part E Case Studies in the Form of Exercises and Examples 11 Pressure control system (exercise) 163 12 Burner control assessment (example) 171 13 SIL targeting – some practical examples 189 14 Hypothetical rail train braking system (example) 198 Appendix 1 Functional safety capability – template procedure 211 Appendix 2 Assessment schedule (checklist) 230 Appendix 3 Betaplus CCF model,checklists 235 Appendix 4 Assessing safe failure fraction and diagnostic coverage 240 Appendix 5 Answers to examples 245 Appendix 6 References 252 Appendix 7 ‘High and low demand’ 255 Appendix 8 Some terms and jargon of IEC 61508 257 Index 261 P r e l i m s . q x d 5 / 2 2 / 0 4 1 0 : 0 0 P a 61508 ge v i i Process Rail Defence Auto- Miscellaneous Other i oil and gas motive 6I1E5C11 SIGRE\1M5 UKOOA S8IS4A.01 OOL7F7 EN 50126 DEF STAN guMidISeRlinAes 00–56 IEC EEMUA DO 178B DIN Machinery (00–54, MISRA 61513 guidelines air standards standards EN 50128 EN 50129 00–55, 00–58 C Standard nuclear NPL superseded) IEC software IEE 62061 guidelines SEMSPLC machinery withdrawn Q124 Assessment guidelines Prelims.qxd 5/22/04 10:00 Page ix A Q O UICK VERVIEW Functional safety involves identifying specific hazardous fail- ures which lead to serious consequences (e.g.death) and then establishing maximum tolerable frequency targets for each mode of failure.Equipment whose failure contributes to each of these hazards is identified and usually referred to as ‘safety- related’.Examples are industrial process control systems,process shutdown systems,rail signalling equipment,auto-motive con- trols, medical treatment equipment etc. In other words, any equipment (with or without software) whose failure can con- tribute to a hazard is likely to be safety-related. Since the publication of the first edition of this book,in 2001, the application of IEC 61508 has spread rapidly through most sectors of industry.Also,the process sector IEC 61511 has been published.The opportunity has therefore been taken to update and enhance this book in the light of the authors’ recent expe- rience.Chapter 5 is now devoted to IEC 61511 and Chapters 13 and 14 have been added to provide even more examples. The maximum tolerable failure rate for each hazard will lead us to an integrity target for each piece of equipment, depending upon its relative contribution to the hazard in ques- tion. These integrity targets are known as ‘safety-integrity levels’ and are usually described by one of four discrete bands described in Chapter 1. SIL 4: the highest target and most onerous to achieve, requiring state of the art techniques (usually avoided) SIL 3: less onerous than SIL 4 but still requiring the use of sophisticated design techniques