Highest Safety Integrity Level Research Articles

A 12-nm Autonomous Driving Processor With 60.4 TOPS, 13.8 TOPS/W CNN Executed by Task-Separated ASIL D Control

This article proposes an automotive safety integrity level (ASIL) D, which is the highest automotive integrity level specified in ISO 26262, and a target application processor for driving automation systems with a high convolutional neural network (CNN) processing performance of 60.4 trillion operations per second (TOPS) with high power efficiency of 13.8 TOPS/W. To achieve both performance and power efficiency, a stream processing architecture specialized for CNN hardware module is adopted to implement many low-power arithmetic units. In addition, 6 MB of local memories are implemented to reduce data transfers between dynamic random access memory (DRAM) and the CNN hardware, thereby improving the execution efficiency of the arithmetic units and saving power consumption caused by the data transfer. In order to support high safety integrity level with power efficiency, we provide safety mechanisms with high failure detection rates only for the hardware used in applications that require ASIL D support. The configuration of two CNN modules can switch between lockstep and single operation depending on the use case, thus achieving a tradeoff between performance and ASIL while maintaining power efficiency. In addition, the freedom from interference (FFI) concept defined in ISO 26262 is achieved by providing mechanisms to prevent low safety level tasks from interfering with high safety level tasks running concurrently inside the processor.

An innovative industrial control system architecture for real‐time response, fault‐tolerant operation and seamless plant integration

Large-scale infrastructure and industrial projects face schedule delays, cost overruns and performance shortfalls. One cause is the late delivery of their control systems that end up being complex and unsuited. To overcome this problem, an innovative industrial control system is proposed that can be commissioned almost effortlessly and delivered on time without functional defects in most large-scale industrial and infrastructure construction projects, while offering high capacity (>25,000 filed devices scanning >100,000 signals) and straightforward scalability, upgradability and maintainability. Designed with a central controller and distributed sensing and actuating devices, and equipped with a cluster of servers and an Ethernet network transporting video, voice and data (>300 video and >750 voice streams), it integrates plant automation technologies with data communication techniques, allowing industrial and information technology applications to coexist and cooperate. While being tolerant to faults and fast in its response, it provides high safety integrity level (>SIL 2) and real-time automatic reaction in repetitive stimuli or occasional events (programmable from 5 to 250 ms). In this paper, with the provided system blueprint and engineering guidelines, this novel system architecture can be built with off-the-shelf components seamlessly integrated in the context of Cyber Physical Systems.

Applying Safety Concepts and Principles in Vital Controller Design

A vital controller is safety critical and its failures, if not mitigated in time, can contribute to hazards in the application system. With electronics advancing and automation increasing, the expanding complexity of a vital controller creates challenges in designing it and assessing its safety integrity level. Typically, traditional safety engineering approaches are not effective for providing systematic guidance to design vital controllers and also not cost efficient for justifying their safety integrity. Through practice on developing multiple Communications-Based Train Control systems, we have identified an approach to using a set of safety concepts as guidance for both safety critical controller design and its safety integrity assessment. These safety concepts are categorized as intrinsic fail-safe, reactive fail-safe, and composite fail-safe. An effective combination of them is applying the composite fail-safe concept in checked redundancy techniques for designing the architecture of a controller, the reactive safety concept for identifying self-testing and monitoring mechanisms in each checked redundant channel, and the intrinsic fail-safe concept for ensuring safe interfaces to other controllers and controlled devices. This paper presents the approach for using these safety concepts and discusses their application principles and verification factors for achieving high safety integrity level of a controller.

An adverse outcome pathway framework to support the assessment of DART liabilities of compounds

Recent developments in technology and the move towards efficient utilisation of resources have inspired researchers and practitioners to come up with cost-effective approaches to Safety Integrity Level (SIL) determination and calculation as the current methods are too cumbersome and time-consuming. The bottom line is meeting the organisation's safety requirements in an economical manner regardless of methodology employed without sacrificing accuracy. This paper proposes the Funnel Risk Graph Method (FRGM) as a funnel technique to assess lower SIL ratings, whilst more complex methods can be applied on higher SILs with caution. A review of various target SIL determination and calculation methods in the life cycle of a Safety Instrumented System (SIS) is also presented and compared as per the criteria of relevant qualifying factors. The key outcome of this review is that the qualitative FRGM can be used as a funnel technique to assess lower SIL ratings whilst more complex methods are applied on higher SILs with caution.

Track Constrained RTK-like Positioning for Railway Applications

Here, we investigate PVT solutions based on multi-constellation receivers and dedicated augmentation networks allowing to determine the track on which a train is operating with a very high safety Integrity level. Because the time needed to accomplish this task has a relevant impact on the rail traffic management performance and, therefore, it is considered a key performance indicator by rail infrastructure managers, a double frequency solution is investigated. Particularly, we focus our attention on the advantages of relative positioning solutions, based on Double-Difference Wide-Laning Carrier Phase measurement combination, exploiting the fact that the train location is completely determined by its mileage due to the track constraint, to speed up track discrimination. No ambiguity fix is required at this scope. Here, a detailed description of the overall processing and achievable performance is given. Performance assessment is provided by means of Monte Carlo simulations based on observations recorded on field campaigns.

Design of a system with a higher safety integrity level out of components with an insufficient safety integrity level

Aim. Technical systems are becoming more and more complex. An increasing number of technical systems contains electronic equipment and software, thus their functional safety is of utmost importance. The safety integrity level is defined by a discrete number that characterizes the set of measures against random and systematic failures depending on the specified risk reduction requirements. The concept of safety integrity levels (SIL) was developed as part of various systems of standards. While the safety architecture of a system is considered, the main question arises: how systems with higher SIL are made out of components and subsystems with low SIL. The answer to that question will allow using existing and certified components in the development of systems with specified safety integrity levels, probably with higher SIL than the SIL of the components. Methods. The paper analyzes and compares the existing rules of system combination with safety integrity levels set forth in various functional safety standards, e.g. EN 50126/8/9, ISO 26262, IEC 61508, DEF-STAN-00-56, SIRF and the Yellow Book. Beside the tolerable failure rates, the system design requirements must make provisions for combining low SIL subsystems to make higher SIL systems. The widest set of methods is defined for SIL 4 compliance. However, this set of methods cannot be reworked for all possible systems into a simple rule for the combination of systems with lower SIL into systems with higher SIL. In general, the combination of systems into a serial structure will make a system with the safety integrity level equivalent to the lowest subsystem safety integrity level. Tentatively, we can assume that by combining two subsystems with the same safety integrity level we can create a system with a safety integrity level one step higher. Results. It is shown that the general SIL allocation rule established in the DEF-STAN-00-56, the Yellow Book or the SIRF standards cannot be recommended for all countries and any situations. Failure rate and/or observation intervals must be taken into consideration. Its is proven that general rules can only be given for subsystems connected in parallel and some SIL combinations (see e.g. the Yellow Book, SIRF). In each case common failures must be taken into consideration. The general rule may be as follows: in order to achieve system SIL one level higher than the initial level, two component subsystems with the SIL one level lower must be connected in parallel. Other system architectures must be thoroughly studied.

Diagnostics of an output interface of a safety-related system with safety PLC

Safety programmable logic controllers (S-PLCs) provide broad application options and are being used to perform control but primarily safety functions (SFs) on the process control level. An essential part of control systems based on S-PLC is the sensors and actuators. In order to ensure the SF with high safety integrity level (SIL), the control system performing this SF has to dispose of a suitable failure detection mechanism and a mechanism providing its safe reaction in case of a failure detection. The diagnostics provided by S-PLC is mainly focused on its own components, and the diagnostics of sensors and actuators has to be resolved on the application program level while respecting some specific properties of S-PLC. This paper addresses the analysis of the influence of S-PLC parameters and diagnostic parameters on the safety function SIL, which is performed by a safety relevant electronic system. In the practical part is described the implementation of application diagnostics in S-PLC and the results of diagnostic parameters influence on safety integrity of SF for a selected example connected to a practical application.

Balancing Time‐to‐Market and Quality in Embedded Systems

ABSTRACTFinding a balance between the time‐to‐market and quality of a delivered product is a daunting task. The optimal release moment is not easily found. We propose to use historical project data to monitor the progress of running projects. From the data we inferred a formula providing a rough indication of the number of defects given the effort spent thus far (effort‐to‐defect formula). Furthermore, we provide a worst case bound to the allowed number of residual defects at the end of a project in order to achieve the required level of quality. For this purpose we slightly modified a well‐known reliability growth model by Bishop and Bloomfield. It turned out that the software in Philips’ MRI scanners has a defect rate of 1 per 1175 device‐years of observation. This coincides with the second highest safety integrity level (SIL3) as defined in the IEC 61508 standard. The highest level (SIL4) is only attainable by applying redundancy. Finally, we combine the effort‐to‐defect formula with the reliability growth model to monitor the progress of a project and to determine when the required level of quality will be reached. We show that a common fault distribution, the Rayleigh model, is not necessarily the best model for predicting the number of residual defects in the system. Using a well‐known data analysis approach called exploratory data analysis (EDA) we obtained an alternative model based on the Normal curve. We have evaluated the Rayleigh model and our model based on the Normal curve at Philips Healthcare MRI. The Normal curve predicts defects over time better than the Rayleigh model in the case of Philips Healthcare MRI. Furthermore, time series models (ARIMA) are also useful for accurately describing the defect trend, but are not suitable for long‐term predictions. Finally, cost estimation models (COCOMO) lack the predictive capabilities of models fitted on the data using EDA. Their capabilities are limited compared to a model derived from data which reflects the constitutional knowledge of the actual realization of systems within a specific company. However, they can still be used to advantage when there is limited or no data available to use as a basis for lifting from gut feel to order of magnitude. © 2013 Wiley Periodicals, Inc. Syst Eng 17

Software Engineering with Formal Methods: The Development of a Storm Surge Barrier Control System Revisiting Seven Myths of Formal Methods

This paper discusses the use of formal methods in the development of the control system for the Maeslant Kering. The Maeslant Kering is the movable dam which has to protect Rotterdam from floodings while, at (almost) the same time, not restricting ship traffic to the port of Rotterdam. The control system, called BOS, completely autonomously decides about closing and opening of the barrier and, when necessary, also performs these tasks without human intervention. BOS is a safety-critical software system of the highest Safety Integrity Level according to IEC 61508. One of the reliability increasing techniques used during its development is formal methods. This paper reports experiences obtained from using formal methods in the development of BOS. These experiences are presented in the context of Hall's famous “Seven Myths of Formal Methods”.