[SystemSafety] words you cannot use at GM

[Maier, Thomas]

As I am currently travelling too, I allow myself to also respond quickly at this point: the suggested implementation of the SIF referred to as "SF", whose safety integrity shall be SIL1, is not in compliance with SIL 1 per IEC 61511:2003.
I hear there are modiications underway in the emerging next edition, which may allow such an implementation. I have only informal & high-level information about this however, not enough to make any statement on compliance.
Before I find time for a more detailed answer, for which I also would need some further clarifications from your side,  I wpould like to ask Bertrand Rique, who appears to have detailed knowledge on both current and emerging editions of 61511, to provide his comment both regarding compliance with IEC 61511:2003 and the upcoming edition.

Med venlig hilsen / Best regards / Mit freundlichen Grüßen

Thomas Maier
E: Thomas.Maier at ul.com
T: +45 42 13 74 52


-----Oprindelig meddelelse-----
Fra: Peter Bernard Ladkin [mailto:ladkin at rvs.uni-bielefeld.de]
Sendt: 22. maj 2014 12:33
Til: Maier, Thomas; systemsafety at lists.techfak.uni-bielefeld.de
Emne: Re: SV: [SystemSafety] words you cannot use at GM



On 2014-05-21 10:14 , Maier, Thomas wrote:
> A correction regarding IEC 615011:
>
> That minimum failure rate per IEC 61511 is specified in Part 1 clause
> 8.2.2: “The dangerous failure rate of a BPCS (which does not conform
> to IEC 61511) that places a demand on a protection layer shall not be assumed to be better than *10^-5 per hour*.”

I grant you that my point was badly expressed, a disadvantage of responding quickly while multitasking on the train. But there is no correction to be made. Bertrand's response to you is abstract but correct.

Let me be more concrete. Suppose you have a safety function SF with SIL 1, which functionality is also provided by the BPCS. The function the BPCS provides, call it BCPS-SF, is by definition not a safety function.

Suppose you implement code in your SIS which does the following.

* 1. Monitors the conditions under which SF should activate in the BCPS;
* 2. Monitors whether BCPS-SF executes successfully;
* 3. Contains SIS-Supplementary-SF, which executes SF.

Now, how reliable does this safety-related code SIS-Supplementary-SF have to be?

Here is the reasoning. The required safety function is SF. The executing code implementing SF is

SF: IF <conditions> THEN BPCS-SF ELSE SIS-Supplementary-SF

The safety-related code here consists of SIS-Supplementary-SF (BPCS-SF is not safety-related by definition). The function SF gets SIL 1. <conditions> is determined by code part 1 above; the test for ELSE by code part 2. Let's assume they are perfect. You may assume that the rate at which the THEN fails is at most 10^(-5), and you need 10^(-6) overall. So....

.... all you need to demonstrate concerning SIS-Supplementary-SF is 10^(-1) reliability. QED.

PBL

Prof. Peter Bernard Ladkin, Faculty of Technology, University of Bielefeld, 33594 Bielefeld, Germany
Tel+msg +49 (0)521 880 7319  www.rvs.uni-bielefeld.de





This e-mail may contain privileged or confidential information. If you are not the intended recipient: (1) you may not disclose, use, distribute, copy or rely upon this message or attachment(s); and (2) please notify the sender by reply e-mail, and then delete this message and its attachment(s). Underwriters Laboratories Inc. and its affiliates disclaim all liability for any errors, omissions, corruption or virus in this message or any attachments.