Functional Safety Standards Research Articles

Enhanced V-Model

Typically, software development processes are time consuming, expensive, and rigorous, particularly for safety-critical applications. Even if guidelines and recommendations are defined by sector-specific functional safety standards, development process may not be completed because of excessive costs or insufficient planning. The V-model is one of the most well-known software development lifecycle model. In this study, the V-model lifecycle is modified by adding an intermediate step. The proposed modification is realized by checking the fault diagnosability of each module. The proposed modification provides three advantages: (1) it checks whether the constructed model covers all software requirements related with faults; (2) it decreases costs by early detection of modeling deficiencies before the coding and testing phases; and (3) it enables code simplicity in decision of fault occurrence.

Design of a system with a higher safety integrity level out of components with an insufficient safety integrity level

Aim. Technical systems are becoming more and more complex. An increasing number of technical systems contains electronic equipment and software, thus their functional safety is of utmost importance. The safety integrity level is defined by a discrete number that characterizes the set of measures against random and systematic failures depending on the specified risk reduction requirements. The concept of safety integrity levels (SIL) was developed as part of various systems of standards. While the safety architecture of a system is considered, the main question arises: how systems with higher SIL are made out of components and subsystems with low SIL. The answer to that question will allow using existing and certified components in the development of systems with specified safety integrity levels, probably with higher SIL than the SIL of the components. Methods. The paper analyzes and compares the existing rules of system combination with safety integrity levels set forth in various functional safety standards, e.g. EN 50126/8/9, ISO 26262, IEC 61508, DEF-STAN-00-56, SIRF and the Yellow Book. Beside the tolerable failure rates, the system design requirements must make provisions for combining low SIL subsystems to make higher SIL systems. The widest set of methods is defined for SIL 4 compliance. However, this set of methods cannot be reworked for all possible systems into a simple rule for the combination of systems with lower SIL into systems with higher SIL. In general, the combination of systems into a serial structure will make a system with the safety integrity level equivalent to the lowest subsystem safety integrity level. Tentatively, we can assume that by combining two subsystems with the same safety integrity level we can create a system with a safety integrity level one step higher. Results. It is shown that the general SIL allocation rule established in the DEF-STAN-00-56, the Yellow Book or the SIRF standards cannot be recommended for all countries and any situations. Failure rate and/or observation intervals must be taken into consideration. Its is proven that general rules can only be given for subsystems connected in parallel and some SIL combinations (see e.g. the Yellow Book, SIRF). In each case common failures must be taken into consideration. The general rule may be as follows: in order to achieve system SIL one level higher than the initial level, two component subsystems with the SIL one level lower must be connected in parallel. Other system architectures must be thoroughly studied.

安全性入門 機能安全規格(信頼性基礎講座)

安全性入門 機能安全規格(信頼性基礎講座)

Safety and Security Analysis of Control Chains in SCADA Using the NFR Approach

The objective of this research is to shed light on the applicability of the Non-Functional Requirements (NFR) Approach to the concept of control chains for the combined analysis of safety and security of SCADA systems and, more generally, to computer systems used in automation, including functional safety and security standards. The paper discusses the concept of control chains, presents an overview of the NFR Approach, and applies this approach to the safety and security analysis of control chains in a case study of the automatic control of the hydrocarbon tank pressure control system.

Providing tool support for specifying safety-critical systems by enforcing syntactic contract conditions

Functional safety standards such as IEC 61508 and ISO 26262 advocate a particularly stringent requirements engineering where safety requirements must be structured in a hierarchical manner and specified in accordance with the system architecture. In contrast to the stringent requirements engineering in functional safety standards, according to previous studies, requirements engineering in industry is in general of poor quality. Contracts theory has been previously shown to be suitable for supporting such a stringent requirements engineering effort; this support has also been implemented in tools. However, to use these contract-based tools, requirements must be formalized, which is a major challenge in industry. Therefore, to support current industrial requirements engineering practice and the stringent requirements engineering in functional safety standards, it is shown how tool support can be provided even when requirements, and also architectures, are not formalized. This is achieved by enforcing syntactic, yet formal, conditions in contracts theory. Despite the need for further validation, initial findings in an industrial case study indicate high potential in realizing the proposed support in an industrial setting.

Failure rate evaluation method for HW architecture derived from functional safety standards (ISO 19014, ISO 25119, IEC 61508)

An important issue concerning the use of safety standards in the design of a complex system is the proper evaluation of the risks. The risk is correlated to the probability of failure, then to the failure rate, and it plays a fundamental role in the safety assessment process. This paper focuses on the failure rate evaluation methods adopted by the following functional safety standards: ISO 19014, ISO 25119, and IEC 61508. All of these standards are applicable, respectively, in the earth-moving machinery, in the tractors and machinery for agriculture and forestry, and in the industrial automation fields. As proposed by the standards, the failure rate evaluation depends on the conventional parameters like Mean Time To Failure, Diagnostic Coverage level, and Hardware Categories. Nevertheless, assuming the same value of these parameters, the results obtained adopting the suggested methods from different standards are not always the same. The aim of this paper is to give an analytical approach to calculate, on a common basis, the failure rate starting from a certain set of input parameters. In addition, the approximations are analysed in order to identify the correct assumptions for the proper application of all these “not exact” values in each application field.

STATE OF THE ART AND DEVELOPMENT PROSPECTS OF FUNCTIONAL SAFETY NORMS AND STANDARDS

Aim. Familiarizing the readers with the state of the art and development prospects of functional safety norms and standards in the Russian Federation. As the safety of any product, service or process is its second most important characteristic after the function, safety-related systems (SRSs) are widely used in order to ensure the safety of industrial, transportation, energy, communication and critical facilities, buildings and structures, urban infrastructure, as well as machines, equipment and vehicles. Unfortunately, since 1980’s the technologies used in the development of the SRSs have not gained full traction in Russia. As the result, a conservative approach is in use that often involves excessive requirements, which increases the cost of the developed safety systems but usually does not guarantee compliance with the requirements. Currently, functional safety (FS) is recognized globally as the primary SRSs characteristic, that indicates the probability of successful performance by the system of the safety function(s) under the given conditions within the given time period. Methods. Globally, the implementation, further development and practical application of the FS method is based on the development and application of a large number of regulatory documents at the international, regional and national levels, that help organize and perform activities related to the assessment and FS requirements compliance confirmation for a wide range of SRSs. In order to ensure methodological support and coordination of the activities aimed at the development of FS-related regulatory framework in the Russian Federation in accordance with the national standard GOST R 1.1-2013 Standardization in the Russian Federation. Technical committees for standardization. Rules of organization and function, the technical committee for standardization TK 058 Functional Safety has been established, is actively working and has so far developed around 50 FS-related standards. The TK 058 standardization activities are based on the provisions of the Federal Law dated June 29, 2015 no. 162-FZ On standardization in the Russian Federation. Conclusions. As in the Russian Federation a certain FS-related regulatory framework has already been established, while the market shows demand for services of FS requirements compliance evaluation, the main task for today is to develop, using national and international requirements, organizational support, regulatory and guidance documentation that would create a fully-fledged infrastructure that implements the national institution of FS requirements compliance verification. That will ensure not only a radical reduction of the risk of disasters and accidents, but also significantly increase the competitiveness of Russian products in the internal and foreign markets.

Model-based diagnosis and fault tolerant control for ensuring torque functional safety of pedal-by-wire systems

This paper presents a model based approach for defining automotive functional safety requirements and provides a solution to ensure functional safety through model-based diagnosis and fault tolerant control. This model-based approach is consistent with ISO 26262 – functional safety standard. In particular, this paper presents the necessary steps for defining and implementing functional safety requirements, including item and function definition, Hazard Analysis and Risk Assessment, as well as the design of a model-based diagnostic and fault tolerant control (FTC) system that can lead to a systematic solution to automotive functional safety problems. The methodology proposed in this paper is applied to the problem of torque functional safety of pedal-by-wire systems.

Using field feedback to estimate failure rates of safety-related systems

The IEC 61508 and IEC 61511 functional safety standards encourage the use of field feedback to estimate the failure rates of safety-related systems, which is preferred than generic data. In some cases (if “Route 2H” is adopted for the "hardware safety integrity constraints”), this is even a requirement. This paper presents how to estimate the failure rates from field feedback with confidence intervals, depending if the failures are detected on-line (called "detected failures", e.g. by automatic diagnostic tests) or only revealed by proof tests (called "undetected failures"). Examples show that for the same duration and number of failures observed, the estimated failure rates are basically higher for “undetected failures” because, in this case, the duration observed includes intervals of time where it is unknown that the elements have failed. This points out the need of using a proper approach for failure rates estimation, especially for failures that are not detected on-line. Then, this paper proposes an approach to use the estimated failure rates, with their uncertainties, for PFDavg and PFH assessment with upper confidence bounds, in accordance with IEC 61508 and IEC 61511 requirements. Examples finally show that the highest SIL that can be claimed for a safety function can be limited by the 90% upper confidence bound of PFDavg or PFH. The requirements of the IEC 61508 and IEC 61511 relating to the data collection and analysis should therefore be properly considered for the study of all safety-related systems.

Development and Validation of Functional Model of a Cruise Control System

Modern automobiles can be considered as a collection of many subsystems working with each other to realize safe transportation of the occupants. Innovative technologies that make transportation easier are increasingly incorporated into the automobile in the form of functionalities. These new functionalities in turn increase the complexity of the system framework present and traceability is lost or becomes very tricky in the process. This hugely impacts the development phase of an automobile, in which, the safety and reliability of the automobile design should be ensured. Hence, there is a need to ensure operational safety of the vehicles while adding new functionalities to the vehicle. To address this issue, functional models of such systems are created and analysed. The main purpose of developing a functional model is to improve the traceability and reusability of a system which reduces development time and cost. Operational safety of the system is ensured by analysing the system with respect to random and systematic failures and including safety mechanism to prevent such failures. This paper discusses the development and validation of a functional model of a conventional cruise control system in a passenger vehicle based on the ISO 26262 Road Vehicles - Functional Safety standard. A methodology for creating functional architectures and an architecture of a cruise control system developed using the methodology are presented.

Functional Safety and Mean Time to Fail for Underground Mining Proximity Detection Device in No-Go-Zones

Abstract: Due to the inevitable proximity of heavy machinery and human workers in mining and tunnelling the risk of severe accidents is high. The paper describes recent worldwide efforts to increase occupational safety in this industry. The major problems and approaches are discussed using the example of the development of proximity detection systems. Due to the hard environmental conditions, guards and protective devices cannot be used in many cases. Consequently functional safety is gaining importance in mining and tunnelling. The standards for functional safety are well-developed for manufacturing industry, but some issues cannot be applied directly in mining and tunnelling. One of these problems is the mean time to fail, which is a condition to reach a required safety integrity level. Small samples of data make statistical conclusion difficult. A method based on Markov chains is presented for this purpose and is compared with a standard method.

Methods of reliability assessment of heterogeneous redundant systems

Reliability assessment is required for the determination of a safety integrity level (SIL) of safety systems in accordance to the functional safety approach. Functional safety standards suggest formulas for calculating PFD/PFH which numerical values are used for establishing correspondence to the SIL. However these formulas cannot be used for heterogeneous redundant systems with a combination of mechanical, electronic/electrical components and constant and non-constant failure rates. In this paper we present an overview of reliability assessment methods that are able to cope with these features of heterogeneous redundant systems, show their advantages, drawbacks and limitations in application.

Systematic Failures, Systematic Capability and Prior-Use

This paper is a discussion of the nature of systematic failures in Safety Instrumented Systems and the way that they can be managed. It identifies the upper bound to the probability of failure due to systematic failures as a function of demand rate and a systematic test interval. It discusses how the functional safety standards address systematic failures through systematic capability defences and how these considerations may be addressed when identifying a ‘Prior-use’ case for assessing fitness-for-purpose of system elements.

QUANTITATIVE ASSESSMENT FOR SOFTWARE SAFETY INTEGRITY LEVEL WITH FUNCTIONAL SAFETY STANDARDS AND RISK COSTS

Reliability and safety for hardware in computer systems have been sufficiently studied in recent years. On the other hand, a safety-related system (SRS) for software has not been assured with the proper method of calculating the software safety integrity level (SIL) in the functional safety standards, which is currently determined only by the number of development methods applied to practical safety-related system (SRSs). In this paper, we discuss quantitative assessment for it by applying quantitative measures based on software reliability growth models (SRGMs) that have been widely and successfully applied to practical software quality management activities. Based on a nonhomogeneous Poisson process (NHPP), the plausible methods of calculating software SIL in the functional safety standard are proposed. Further, we discuss the quantitative method for assuring software SIL based on the optimal release policies with the test cost during testing-environment and the risk cost after the software products will be released.

Six months of exclusive breastfeeding recommendation: How applicable is the universal exclusive breastfeeding recommendation policy?

Public health organisations, including the World Health Organisation recommend 6 months of exclusive breastfeeding for optimal growth, cognitive development and health . In addition, the provision of nutritionally adequate and safe complementary foods to the infants while breastfeeding continues up until 2 years of age and beyond is also recommended . Exclusive breastfeeding for the first 6 months of life meets the energy and nutrient needs of the infants. The objective of this review therefore, is to assess the appropriateness of a universal 6 months exclusive breastfeeding recommendation policy in both developed and developing countries. In the last years, recommendations for the optimal duration of exclusive breastfeeding promoted by WHO and UNICEF started to differ. The World Health Organization had recommended exclusive breastfeeding for 4 to 6 months, with the introduction of complementary foods thereafter, whereas UNICEF preferred the wording “for about 6 months”. This led to concerns in larger infant nutrition and public health communities. The American Academy of Pediatrics’ position was also unclear: In two different sections of their Pediatric Nutrition Handbook, recommending human milk “as the exclusive nutrient source for babies during the first 6 months” and “the delayed introduction of solid foods until 4 to 6 months”. Until recently, the only scientific evidence that contributed to the exclusive breastfeeding duration debate was based on observational studies, with well -recognized sources of potential bias. Reverse causality was another potential source of bias, particularly with respect to infectious morbidity and neuro- motor development. Infants who developed a clinically important infection were likely to become anorectic and experienced reduced breast milk intake that led to reduction in milk production and even termination of breastfeeding. The lack of functional and effective food safety standards and policies, safe drinking water, exclusive breastfeeding promoting programs, high infection rates and the broken healthcare systems in the developing countries unlike in the developed countries, are key areas that need further research before the 6 months recommended duration of exclusive breastfeeding can be reduced and/or changed to 4 months, to avoid child morbidity and mortality. It is also important that the 6 months of exclusive breastfeeding are promoted in all developing countries and 4- 6 months in all developed countries.

ISO 26262 표준 기반의 소프트웨어 검증을 위한 소프트웨어 결함 주입 기법

As the number of ECUs (Electronic control units) are increasing, reliability and functional stability of a software in an ECU is getting more important. Therefore the application of functional safety standards ISO 26262 is making the software more reliable. Software fault injection test (SFIT) is required as a verification technique for the application of ISO 26262. In case of applying SFIT, an artificial error is injected to inspect the vulnerability of the system which is not easily detected during normal operation. In this paper, the basic concept of SFIT will be examined and the application of SIFT based on ISO26262 will be described.

High Voltage Safety Management System Design Based on Functional Safety

High voltage system as power source is applied to electric school buses. In this paper, failures and potential risks of high voltage system are analyzed according to the electric school bus high voltage system configuration, and the high voltage safety management system is designed with ISO26262 as a functional safety standard. The strategies of system diagnostics and safety management are proposed to achieve the safety requirements to electric vehicles, which improve the reliability of electric vehicles and reduce the cost of maintenance.

SIL determination: Recognising and handling high demand mode scenarios

The International Standards for Functional Safety (IEC 61508 and IEC 61511) are well recognised and have been adopted globally in many of the industrialised countries during the past 10 years or so. Conformance with these standards involves determination of the requirements for instrumented risk reduction measures, described in terms of a safety integrity level (SIL). During this period within the process sector, layer of protection analysis (LOPA) has become the most widely used approach for SIL determination. Experience has identified that there is a type of hazardous event scenario that occurs within the process sector that is not well recognised by practitioners, and is therefore not adequately handled by the standard LOPA approach. This is when the particular scenario places a high demand rate on the required safety instrumented function. This paper will describe how to recognise a high demand rate scenario. It will discuss what the standards have to say about high demand rates. It will then demonstrate how to assess this type of situation and provide a case study example to illustrate how to determine the necessary integrity level. It will conclude by explaining why it is important to treat high demand rate situations in this way and the resulting benefit of a lower but sufficient required integrity level.

Performance Evaluation of GNSS for Train Localization

Global Navigation Satellite Systems (GNSS) are applicable to deliver train locations in real time. This train localization function should comply with railway functional safety standards; thus, the GNSS performance needs to be evaluated in consistent with railway EN 50126 standard [Reliability, Availability, Maintainability, and Safety (RAMS)]. This paper demonstrates the performance of the GNSS receiver for train localization. First, the GNSS performance and railway RAMS properties are compared by definitions. Second, the GNSS receiver measurements are categorized into three states (i.e., up, degraded, and faulty states). The relations between the states are illustrated in a stochastic Petri net model. Finally, the performance properties are evaluated using real data collected on the railway track in High Tatra Mountains in Slovakia. The property evaluation is based on the definitions represented by the modeled states.

Power And Fault Emulation for Software Verification and System Stability Testing in Safety Critical Environments

In recent years the complexity of digital control systems in safety critical environments increased steadily from simple discrete control units to complex embedded systems. A wide industrial consensus about the necessity of a set of safety definitions lead to the introduction of several functional safety standards like IEC61508. To achieve that novel embedded systems comply with these requirements, thorough testing is needed during early design stages of the integrated device. Currently only fault injection testing using manufactured products and netlists of system-on-chips are used to determine the fault resistance of the embedded system. This late testing could result in expensive redesigns and hide implementation errors because of the black-box approach. This approach is also not practicable if software and hardware providers are separate entities. This paper presents a flexible fault injection and power estimation platform to enable thorough examinations of novel complex system-on-chips for automotive or similar critical environments. The microprocessor evaluation approach is extended with smart bus fault emulation units for common buses like Ethernet. The combined power and fault emulation techniques allow for the instant exploration of eventual power supply peaks and implementation weaknesses.