Safety lifecycle requirements

The standard recognizes that the specified activities might be structured in different ways, provided that all the requirements are complied with. This restructuring can be beneficial if it allows safety activities to be better integrated into normal project procedures. The purpose of Clause 6 of lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (lEC 61511-1 Mod) is to ensure that if a different safety lifecycle is used, the inputs and output of each phase of the lifecycle are defined and all essential requirements are incorporated. 

Copyright International Society of Automation Provided by IMS under license with ISA 

No reproduction or networking permitted without license from IMS 

1 The key consideration is to define in advance the safety lifecycle of the SIS that is going to be used. Experience has shown that probiems are likely to occur, unless this activity is planned well in advance and agreements are reached with all persons, departments and organizations taking responsibility. At best, some work will be delayed or have to be redone at worst, safety can be compromised. 

3 Another important part of safety lifecycle planning is to identify the techniques that will be used during each phase. The identification of such techniques is important since it is often necessary to use a specific technique that requires persons or departments with unique skills and experiences. For instance, consequences in a particular application may be dependent on the maximum pressure developed after a failure event and the only way this can be determined is to develop a dynamic model of the process. The information requirements for dynamic modelling will then have an important impact on the design process. 

---

The functional safety achieved in any process facility is dependent on a number of activities being carried out in a satisfactory manner. The purpose of adopting a systematic safety lifecycle approach towards a safety instrumented system is to ensure that all the activities necessary to achieve functional safety are carried out and that it can be demonstrated to others that they have been carried out in an appropriate order. lEC 61511-1 ANSI/ISA-84.00.01-2004 Parti (lEC 61511-1 Mod ) sets out a typical lifecycle in Figure 8 and Table 2. Requirements for each lifecycle phase are given in Clauses 8 through 16 of lEC 61511-1 ANSI/ISA-84.00.01-2004 Part 1 (lEC 61511-1 Mod). 

The purpose of verification is to ensure that the activities for each safety lifecycle phase, as determined by verification planning, have, in fact, been carried out and that the required outputs of the phase, whether they be in the form of documentation, hardware or software, have been produced and are suitable for their purpose. 

The development of the SIS safety requirements specification is one of the more important activities of the whole safety lifecycle. It is through this specification that the user is able to define how he wants the Safety Instrumented Functions (SIF) to be designed and integrated into a SIS. 

The Safety Lifecycle (SLC) is an engineering process that contains all the steps needed to achieve high levels of functional safety during conception, design, operation, and maintenance of instrumentation systems. Its objective is clear An automation system designed according to SLC requirements will predictably reduce risk in an industrial process. A simple version of the SLC is shown in Figure 1-3. 

The safety lifecycle from the ANS1/1SA84.00.01-2004 (lEC 61511 Mod) standard is shown in Figure 1-5. Although the drawing looks quite different from Figure 1-4, the fundamental requirements are much the same. Again, there are clear analysis, realization, and operation phases. 

The safety lifecycle from ANSl/lSA-84.00.01-2004 (lEC 61511 Mod) was created specifically for the process industries, and thus many requirements are tailored for process applications. Note that there is an emphasis on managing functional safety on the structure and planning of the safety lifecycle and on verification throughout the entire lifecycle. 

In the safety lifecycle, a safety requirements specification is done after ... 

It also needs to be emphasized that SIL is a lifecycle issue and although our present focus is in the hardware solutions required to satisfy the safety functions, all phases of the Safety Lifecycle have to be reviewed for final SIL verification. For all the examples and solutions, a low demand mode of operation is assumed since this is the mode that predominantly applies to the process industries. 

It is required to manage the functional safety in entire safety lifecycle keeping the risk level of potential hazardous events at acceptable level. Thus, it is essential to modernize and improve when required the basic process control system (SCADA and DCS) and the safety-related systems including the alarm system based on experience from their operation and periodical risk assessment. In such process it is essential to consider carefully the human and organizational factors using relevant HRA methods to maintain adequate risk associated with operation of complex industrial hazardous plants. 

The required SIL designates the methods and measures that have to be executed during the overall safety lifecycle phases. The SIL is a probabilistic quantitative concept. If certain techniques and measures are applied one expects on average that a certain reliability of the safety functions is realized. Besides statistic and systematic hardware errors this concept also takes systematic software failures into account. 

How the above should be applied specifically to the two main stages of the safety development lifecycle - requirements determination and requirements satisfaction -and is discussed respectively in paragraphs 4.5and 4.6 below - see also (Fowler,... 

Maintain this information throughout the overall safety lifecycle However many designs require iteration an a spiral lifecycle model is indicated... 

The activities of the software safety lifecycle are organised into a number of phases including safety requirements specification architecture design selection of support tools and translators detailed software design and coding module and integration testing In each phase there is a verification exercise that aims to find errors introduced in the development process. 

ANSI/ISA-84.00.01-2004 gives requirements for the specification, design, installation, operation and maintenance of SIS, so that it can be confidently entrusted to place and/or maintain the process in a safe state. These requirements are presented in the standard, using the safety lifecycle shov /n in ANSI/ISA-84.00.01-2004-1, Figure 8, and described in ANSI/ISA-84.00.01-2004-1 Table 2. 

Safety lifecycle phase or activity Objectives ANSI/ISA-84.00.01 Requirements Clause ISA-84 Technical Report Reference... 

SIS modification To make corrections, enhancements, or adaptations to the SIS, ensuring that the required safety integrity level is achieved and maintained. 17 Apply appropriate safety lifecycle phase during management-of-change activity. 

Within ANSI/ISA-84.00.01-2004-1, MOC is a significant phase of the Safety Lifecycle Model. Prior to the initiation of a change to the SIS or to the process, the impact of the change on the SIS performance should be assessed according to the requirements of the appropriate lifecycle phase, i.e., the first phase affected by the modification. The elements of all subsequent lifecycle phases are then addressed. This includes evaluating the effect of the change on the SIL. 

ANSI/ISA-84.00.01-2004-1 addresses the competency requirements for individuals involved in the safety lifecycle. Competency requirements are not addressed in ANSI/ISA-84.01-1996, because competency was already addressed in OSHA 1910.119 for all disciplines involved in process plant design, maintenance, and operation. Since the standard has an international scope, the competency requirements are presented for the benefit of those owners/operators that do not have a regulatory system in place that defines these requirements. ISA-TR84.00.04-1 Annex C provides additional guidance on the management of functional safety through effective project management and quality control processes. 

ANSI/ISA-84.01-1996 requires that the application software be developed in accordance with the Safety Requirements Specification (SRS). ANSI/ISA-84.00.01-2004-1 also requires this, but discusses the development of the application software with relation to the safety lifecycle. Where hardware is prone to random failures, the software is more prone to systematic failures. The safety lifecycle is important, because it is the primary mechanism for reducing systematic failure. The inclusion of the lifecycle discussion in the software section does result in repetition of the design process described in ANSI/ISA-84.00.01-2004-1 Clause 11. This repetition is intended to highlight the importance of the lifecycle in the development, verification and validation of application software. ISA-TR84.00.04-1 Annex O provides a discussion of the evolution of application software development. 

In order to deal in a systematic manner with all the activities necessary to achieve the required safety integrity for die E/E/PE safety-related systems, lEC 61508 adopts the Overall Safety Lifecycle indicated in Figure 3 (lEC 61508/Edition 2 shown) as the technical framework. The Overall Safety Lifecycle specified in lEC 61508 should be used as a basis for claiming conformance to the standard, but a different Overall Safety Lifecycle can be used to that given in Figure 3, providing the objectives and requirements of each clause of the standard are met. 

This change in the competence requirements in lEC 61508/Edition 2 extends the normative requirements for competence across all safety lifecycle activities. In lEC 61508/Edition 1, the normative requirement for competence was restricted to the Functional Safety Assessment activity-... 

This clause specifies requirements for the management and technical activities during the overall, E/E/PEs, and software safety lifecycle phases. It is also to specify the responsibilities of the persons, departments, and organizations responsible for each overall, E/E/PE system and software safety lifecycle phase or for activities within each phase. Basic requirements/issues shall include but are not limited to those listed below. It is advisable to refer associated clause (6) of 61508-1 Latest revision (2010) to note the changes with respect to previous revisions. 

There are a number of requirements specified for nonlisted PLCs. According to A8.3 (P37) of NFPA 87 (2015) Controls that meet the perfomumce-based requirements of standards such as ANSI/ISA 84-00.01 Application of Safety Instrumented Systems for the Process Industries, can be considered equivalent. The determination of equivalency involves complete conformance to the safety lifecycle including risk analysis, safety integrity level selection, and safety integrity level verification, which should be submitted to the authority having jurisdiction. 

These systems should be designed, implemented, documented, and have a regime of safety lifecycle management necessary to achieve the required SIL in compliance with BS EN 61511. 

We have gone through the complete chain in the safety lifecycle, from Safety Goals to AUTOSAR BSW requirements. Unlike application software, where the link to safety is more direct, safety requirements allocated on the platform software are challenging to identify. However, if successful it significantly reduces the cost for achieving complete evidence in a safety argumentation. 

S.2.3 An analysis shall be carried out on the impact of the proposed software modification on the functional safety of the E/E/PE safety-related system a) to determine whether or not a hazard and risk analysis is required b) to determine which software safety lifecycle phases will need to be repeated. 

S.2.5 All modifications which have an impact on the functional safety of the E/E/PE safety-related system shall initiate a return to an appropriate phase of the software safety lifecycle. All subsequent phases shall then be carried out in accordance with the procedures specified for the specific phases in accordance with the requirements in this standard. Safety planning (see Clause 6) shall detail all subsequent activities. 

The safety lifecycle for l C equipment Reliability requirements for high-integrity systems Software quality management Functional specifications and traceability Setting up a high-integrity software project Common-mode failure I C architecture... 

The project safety lifecycle for the design, operation and eventual decommissioning of a hazardous plant is summarized in Fig. 2.1. The most important purposes of the safety lifecycle are to ensure that (a) design work is properly planned, and (b) safety requirements are traceable from beginning to end. 

---