Functional safety standards

The lEC 61508 standard defines safety as freedom from unacceptable risk (Ref. 1). Functional safety has been defined as part of the overall safety relating to the process and the Basic Process Control System (BPCS) which depends on the correct functioning of the SIS and other protection layers. The phrase correct functioning of the SIS identifies the key concern. A high level of functional safety means that a safety 

Functional safety is thus the primary objective in designing a safety instrumented system (SIS). To achieve an acceptable level of functional safety, several issues must be considered that may not be part of the normal design process for automation systems. These issues are provided as requirements in international standards. 

When the first programmable electronic equipment, called programmable logic controllers (PLCs), were created as an alternative to relay logic, many engineers immediately believed these new devices would be perfect for automatic protection applications. They felt that the functionality of these electronic devices encompassed aU that would be needed and more. 

One of the more influential documents on SIS was called Programmable Electronic Systems in Safety Related Applications, which was published by the Health and Safety Executive (HSE) in the United Kingdom (Ref. 2 and 3). Early national standards for SIS include Grundsatze fur Rechner in Systemen mit Sicherheitsaufgaben, published in Germany (Ref. 4 and 5) in 1990 and ANSI/ISA-84.01-1996, Application of Safety Instrumented 

A secondary goal of the standard is to enable the development of electrical/electronic/programmable electronic (E/E/PE) safety-related systems where specific application sector standards do not already exist. lEC 61511 is an industry-specific standard for the process industries that is 

---

It has been demonstrated, that mass deployment of networked, dependable embedded systems with critical control functions require a new, holistic system view on safety critical and security critical systems. Both communities have to interact, communicate and integrate at the end. A unified approach to address the safety AND security requirements of safety related systems is proposed, based on the functional safety standard IEC 61508 and IT-Security management standards, handbooks and guidelines. 

Many never consider a person to be part of a safety instrumented function. When reviewing the definitions used in functional safety standards, there is little indication that this was ever intended. A process operator takes action when normal process operating conditions are violated. The operator normally responds to these violations from alarms. The operator action is, therefore, normally considered as being part of the alarm layer of protection, not the SIS. 

Current functional safety standards, lEC 61508 and ANSl/lSA-84.00.01-2004 (lEC 61511 Mod), (Ref. 1 and 2) state that probabilistic evaluation using failure rate data be done only for random failures. To reduce the chance of systematic failures, the standards include a series of "design rules" in the form of specific requirements. These requirements state that the safety instrumented system designer must check a wide range of things in order to detect and ehcninate systematic failures. 

Even with approximate data, the methods began to show how designers could achieve higher levels of safety while optimizing costs. The safety verification calculations required by the new functional safety standards have shown designers how to design much more balanced designs. The calculations have shown many how to do a better job. But, failure rate and failure mode data for random failures on the chosen equipment is required. 

The concept of the "well designed system" was also presented in Chapter 3. A simplistic definition of such a system would be one where aU the techniques and measures presented in our functional safety standards to prevent systematic failures are followed. These techniques and measures are planned to significantly reduce the chance of a systematic fault to a tolerable level. Therefore, systematic failure rates caused by human error including failures due to installation errors, failures due to calibration errors and failures due to choosing equipment not suited for purpose are not included in the calculation. 

This is not to say that systematic errors cannot happen. It is clearly recognized that these failures do occur and that they do impact safety integrity. One field failure study done by one of the authors traced instrument failure reports to specific end user sites. The results showed that failure rates for the same instrument varied by over an order of magnitude from site to site. There is no doubt that this is significant. But the site specific and even person specific variables preclude an "average" probabilistic approach. That is why it is so important to understand and follow all the procedures, techniques and measures presented in the functional safety standards to avoid and control systematic failures. It is so important to have a "well designed system" for any safety instrumented function. 

In the opinion of committee members on functional safety standards, some of the above factors cannot be practically quantified, e.g., systematic faults like software bugs or procedural errors. Hence functional safety standards provide requirements for protection against systematic faults as well as requirements to do probabilistic calculations to protect against random failures. For the typical SIF solutions being reviewed in this chapter the results of probabilistic SIL verification calculations, including architecture limitations per lEC 61508 (Ref. 1), will be used to demonstrate whether the design satisfies the SIL requirements. 

SIL refers to Safety Integrity Level. The number 3 is a numeric term that specifies the relative integrity of its safety function performance—the probability that it will perform as designed when required to perform. A SIL 3 compliant brake system means that the system is designed according to the lEC 61508/62061 (lEC, 2014) functional safety standards framework and there is a high probability that it will function as designed and correctly when called upon. 

The intent of lEC 61508/62061 is to provide manufactarers, specifiers and owners with an internationally recognized functional safety standards framework to be used for the design, implementation, operation, maintencmce and decommissioning of a functional safety system. 

It could point out a recommended Functional Safety Standard and specify a minimum safety integrity level for controls and supervisions that monitor the mine hoist against its most critical hazardous events. These controls and supervisions would then be developed and designed according to this standard management plan and its required process activities. 

The historical development of this type of monitoring equipment goes from electromechanical units as the Lilly Controller via electronic units and standard-PLCs used together with basic sensors and actuators to todays requirements to use electronic/programmable systems together with sensors and actuators that all are designed according a Functional Safety standard. 

It is important to acknowledge that modern functional safety standards as [ISO 13849-1 ] and [lEC 62061] only cover safety functions reahzed by E/E/PE safety-related systems. 

THE IMPLICATION OF CHOOSING A CERTAIN FUNCTIONAL SAFETY STANDARD... 

This paper will focus on the implication of choosing a certain functional safety standard when designing a complete safety function and thus only those parts of [ISO 13849-1] that are applicable at system level will be considered. The same can not be said for [lEC 62061 ] because this standard only focuses on system level (except for requirements related to electromechanical components). [lEC 62061] requires that the PE-based subsystems shall be developed according to [lEC 61508]. 

Functional Safety Standards and Application to Upgrading Mine Hoists... 

The terminology utilized in this annex is taken from existing functional safety standards (e.g., lEC 61508, ANSI/ISA-84.01-1996, ANSI/ISA-84.00.01-2004). However, the context and meaning of these terms vary slightly depending on which functional safety standard is referenced. As a result, it is essential that key terms be clearly defined in the context of this annex. 

---