SIL Part 3: Systematic Capability

 

What is functional safety?

Functional safety is the active detection of potentially dangerous conditions, resulting in a demand of a protective mechanism or function to prevent or reduce the impact of hazardous events that might occur.

 

Forming part of the overall safety of equipment under control (EUC), functional safety has focus on electronics and related software.

 

IEC 61508 is an international standard for “Functional Safety or electrical/electronic/programmable electronic safety-related systems”. As the umbrella standard for functional safety, it forms the foundation of many industry specific derivatives such as IEC 61511 for the process industry.

 

Following a safety lifecycle model, the standards formalize the management of functional safety and provide measures and techniques for the design of Safety Instrumented Systems (SIS) and associated Safety Instrumented Functions (SIF).

 

IEC 61511 Safety lifecycle

 

A key element of the safety lifecycle is the creation of the Safety Requirement Specification (SRS). Based on inputs from the hazard and risk assessment stages of the lifecycle, this document is the blueprint for the functionality, integrity and validation of the safety system design.

 

 

What is SIL?

The Safety Requirement Specification will document the level of any residual risk reduction required of the safety system design and assign a corresponding target SIL level.

 

SIL or Safety Integrity Level, is a relative level of risk reduction provided by a safety function. Four separate SIL levels from 1 to 4 are defined, with SIL 4 offering the highest level of safety integrity and corresponding risk reduction factor.

 

SIL	Risk Reduction Factor - RRF
4	> 10,000 to ≤ 100,000
3	> 1000 to ≤ 10,000
2	> 100 to ≤ 1,000
1	>10 to ≤ 100

 

 

How is a specific SIL achieved?

SIL achievement requires that the design of a safety function meets three specific criteria as outlined in the standard.

 

These strict criteria are: Random hardware integrity, Architectural constraints and Systematic capability.

 

This section will concentrate on number 3 – System Capability. For information on Random Hardware Integrity and Architectural Constraints please click on the relevant links.

 

PR electronics offers a range of SIL certified devices to cover a wide selection of SIL applications.

 

What is systematic capability?

IEC 61508-2010 defines systematic capability as:

 

"A measure (expressed on a scale of SC 1 to SC 4) of the confidence that the systematic safety integrity of an element meets the requirements of the specified Safety Integrity Level (SIL), in respect of the specified element safety function, when the element is applied in accordance with the instructions specified in the compliant item safety manual for the element."

 

Systematic faults are primarily the result of human failure. Whether it is in the design, engineering, operation or maintenance of a safety function, systematic failures can be introduced which will occur given the correct set of circumstances.

 

Systematic faults are often the result of inappropriate device or component specification, errors in operating or maintenance procedures or bugs in software. Systematic failures will continue to manifest themselves until there is a redesign of the offending root cause.

 

Systematic integrity therefore can be defined as the level of defense against systematic failures.

 

Demonstrating systematic safety integrity

IEC 61511 allows for 2 methods of demonstrating systematic capability:

 

• Use of IEC 61508 certified devices
• Prior-use justification

 

Use of IEC 61508 certified devices

Depending on the SIL level required, IEC 61508 puts stringent demands on the design, fault avoidance and testing of equipment. This ensures that manufacturers follow a strict and repeatable process with full accountability and accompanying documentation.

 

A selection of tables is provided with relevant techniques and measures for manufacturers to follow, and in turn to demonstrate compliance with the relevant SIL level.

 

Technique/measure	See IEC 61508-7	SIL 1	SIL 2	SIL 3	SIL 4
Program sequence monitoring	A.9	HR low	HR low	HR medium	HR high
Failure detection by on-line monitoring	A.1.1	R low	R low	R medium	R high
Tests by redundant hardware	A.2.1	R low	R low	R medium	R high
Standard test access port and boundary-scan architecture	A.2.3	R low	R low	R medium	R high
Code protection	A.6.2	R low	R low	R medium	R high
Diverse hardware	B.1.4	- low	- low	R medium	R high

IEC 61508-2010 Table A.15 – Techniques and measures to control systematic failures caused by hardware design

 

 

The table above is one example of many, each of which focuses on a particular design aspect.

 

Depending on the SIL level required each technique/measure will have an indication as to whether it is Mandatory (M), Highly Recommended (HR), Recommended (R) or Not Recommended (NR). The table will also indicate the required effectiveness of the measure against systematic failures.

 

IEC 61508 certified devices will have undergone an accredited third-party audit of all the compliance requirements, ensuring all the relevant design, test and documentation techniques and measures have been applied appropriate to the SIL level.

 

SIL certificates should indicate the relevant SC level.

 

 

Prior-use justification

The consensus could be that a case is made for reliable use of the device if a particular user had extensive experience of a device, and they had sufficiently low failures.

 

However to fully justify this, it could be assumed that the user must have a robust system in place to fully document ALL failures and failure modes, together with strict version control of hardware and software variants which could impact previous experience. Also, to ensure consistency of the data, any new proposed application must have similar operating conditions to the historical data.

 

IEC 61511 clause 11.5.3 outlines the requirements for selecting devices based on a prior-use justification.

 

"Appropriate evidence shall be available that the devices are suitable for use in the Safety Instrumented System including:

 

• consideration of the manufacturer’s quality, management and configuration management systems
• adequate identification and specification of the devices
• demonstration of the performance of the devices in similar operating environments
• the volume of operating experience."

 

Higher SIL levels put additional demands on any prior-use justification, especially where software is included.

 

A prior-use justification can be very difficult for an end user to fully evidence, and as such many end users are taking advantage of the growing number of IEC 61508 certified devices to demonstrate systematic capability.

 

Demonstrating Systematic Capability does not in itself prove target SIL achievement. Consideration must also be given to Random Hardware Integrity and Architectural Constraints.