MANAGEMENTIEC 61508:2010
Functional Safety Management
A summary of IEC 61508:2010 – safety lifecycle, safety integrity levels (SIL), the CASS certification scheme and terminology. Reference material from MTL Instruments, presented by VTL TECH – MTL representative in Vietnam.
IEC 61508 & safety lifecycle
In the process industries, safety can be defined as being protected from unacceptable risk of injury or damage to people, property or the environment. Functional Safety relates to the part of overall safety that depends upon the correct operation of an electrical/electronic/programmable electronic safety instrumented system, SIS. The requirements for such a SIS are defined in the IEC 61508 group of standards.
Functional safety of E/E/PE safety-related systems
Process industry sector
Nuclear power plants
Safety of machinery E/E/PES
Safety of simple machinery
Power drives
IEC 61508 aims to:
- release the potential of E/E/PE technology to improve both safety and economic performance;
- enable technological developments to take place within an overall safety framework;
- provide a technically sound, system based approach, with sufficient flexibility for the future;
- provide a risk-based approach for determining the required performance of safety-related systems;
- provide requirements based on common underlying principles to facilitate:
- improved efficiencies in the supply chain for suppliers of subsystems and components to various sectors;
- improvements in communication and requirements (i.e. to increase clarity of what needs to be specified);
- the development of techniques and measures that could be used across all sectors, increasing available resources;
- the development of conformity assessment services if required.
Functional Safety Management
A basic requirement of the standards is that all aspects of the safety lifecycle activities demonstrate Functional Safety Management. As well as concerns for equipment, this includes management of personnel competency, covering the end-user, contractors, suppliers and sub-contractors.
(In the UK see also guidance from HSE’ “Managing competence for safety-related systems”.) The MTL Application Note AN9025 provides an introduction to the subject. MTL Instruments are members of ‘The 61508 Association’.
Certificate No. CASS 00015/01
Overall framework of the IEC 61508 series
Technical Requirements
Other Requirements
Overall safety lifecycle
CASS scheme
CASS is a scheme for assessing the compliance of safety related systems with the requirements of IEC 61508 and associated standards. It provides a systematic approach to be used by certification bodies and others when assessing compliance at all stages from the specification of safety requirements through the design, development and manufacture of system components to integration, commissioning, operation and maintenance.
Accredited Certification for Safety Systems… to IEC 61508 and related standards
Relationship between CASS assessment types
E/E/PE system safety lifecycle (in realisation phase)
Relationship between & scope of IEC 61508-2 & IEC 61508-3
Safety integrity levels
Safety integrity is the ability of the SIS to perform the required safety function as and when required. Four levels of safety integrity are defined, each corresponding to a range of target likelihood of failures of a safety function. Safety integrity level 4 (SIL4) is the highest level of safety integrity and safety integrity level 1 (SIL1) is the lowest level.
Note that a safety integrity level is a property of a safety function rather than of a system or any part of a system.
Safety integrity is considered to be composed of the following two elements:
- Hardware safety integrity; that part of safety integrity relating to random hardware failures in a dangerous mode of failure. It may be necessary to use redundant architectures to achieve adequate hardware safety integrity.
- Systematic safety integrity; that part of safety integrity relating to systematic failures in a dangerous mode of failure. Techniques such as redundant channels of identical hardware, which are very effective at controlling random hardware failures, are of little use in reducing systematic failures such as software errors.
Devices, elements and systems may be Type A or Type B.
Type A is when the components required to perform a specified function meet all of the following:
a) The failure modes of all components are well defined; and
b) The behaviour of the device under fault conditions can be completely determined; and
c) There is sufficient dependable failure data to show that the claimed failure rates for detected and undetected dangerous failures are met.
Type B is simply when one or more of the components required to perform a specified function is not Type A.
| Safety Integrity Level (SIL) | Average frequency of a dangerous failure of the safety function [h⁻¹] (PFH) |
|---|---|
| 4 | ≥ 10⁻⁹ to < 10⁻⁸ |
| 3 | ≥ 10⁻⁸ to < 10⁻⁷ |
| 2 | ≥ 10⁻⁷ to < 10⁻⁶ |
| 1 | ≥ 10⁻⁶ to < 10⁻⁵ |
| Safety Integrity Level (SIL) | Average probability of a dangerous failure on demand of the safety function (PFDavg) |
|---|---|
| 4 | ≥ 10⁻⁵ to < 10⁻⁴ |
| 3 | ≥ 10⁻⁴ to < 10⁻³ |
| 2 | ≥ 10⁻³ to < 10⁻² |
| 1 | ≥ 10⁻² to < 10⁻¹ |
While every effort has been made to ensure that the information contained within this document is accurate and up to date, MTL Instruments makes no warranty, representation or undertaking whether expressed or implied, nor does it assume legal liability, whether direct or indirect, or responsibility for the accuracy, completeness, or usefulness of any information.
| Safe failure fraction of an element | Hardware fault tolerance | ||
|---|---|---|---|
| 0 | 1 | 2 | |
| < 60 % | SIL 1 | SIL 2 | SIL 3 |
| 60 % – < 90 % | SIL 2 | SIL 3 | SIL 4 |
| 90 % – < 99 % | SIL 3 | SIL 4 | SIL 4 |
| ≥ 99 % | SIL 3 | SIL 4 | SIL 4 |
| Safe failure fraction of an element | Hardware fault tolerance | ||
|---|---|---|---|
| 0 | 1 | 2 | |
| < 60 % | Not Allowed | SIL 1 | SIL 2 |
| 60 % – < 90 % | SIL 1 | SIL 2 | SIL 3 |
| 90 % – < 99 % | SIL 2 | SIL 3 | SIL 4 |
| ≥ 99 % | SIL 3 | SIL 4 | SIL 4 |
Terminologies & abbreviations
Definitions and abbreviations
| Abbreviation | Full expression |
|---|---|
| AC/DC | Alternating current/direct current |
| AIChE | American institute of chemical engineers |
| ALARP | As Low As Reasonably Practicable |
| ANSI | American National Standards Institute |
| ASIC | Application Specific Integrated Circuit |
| BPCS | Basic process control system |
| CCF | Common Cause Failure |
| CPLD | Complex Programmable Logic Device |
| CCPS | Center for chemical process safety |
| DC | Diagnostic Coverage |
| (E)EPLD | (Electrically) Erasable Programmable Logic Device |
| E/E/PE | Electrical/Electronic/Programmable Electronic |
| E/E/PE (system) | Electrical/Electronic/Programmable Electronic System |
| EEPROM | Electrically Erasable Programmable Read-Only Memory |
| EPROM | Erasable Programmable Read-Only Memory |
| EMC | Electro-magnetic compatibility |
| EUC | Equipment Under Control |
| FAT | Factory acceptance testing |
| FPGA | Field Programmable Gate Array |
| FPL | Fixed program language |
| FSA | Functional safety assessment |
| FTA | Fault tree analysis |
| FVL | Full variability language |
| GAL | Generic Array Logic |
| H&RA | Hazard & risk assessment |
| HFT | Hardware Fault Tolerance |
| IEC | International Electrotechnical Commission |
| IEV | International Electrotechnical Vocabulary |
| ISA | Instrumentation, Systems & Automation Society |
| ISO | International Organization for Standardization |
| LVL | Limited variability language |
| MooN | M out of N channel architecture (for example 1oo2 is 1 out of 2 architecture, where either of the two channels can perform the safety function) |
| MooND | M out of N channel architecture with Diagnostics |
| MTBF | Mean Time Between Failures |
| MTTR | Mean Time To Repair |
| MRT | Mean Repair Time |
| NP | Non-programmable |
| PAL | Programmable Array Logic |
| PE | Programmable Electronic |
| PES | Programmable electronic system |
| PFD | Probability of Dangerous Failure on Demand |
| PFDavg | Average Probability of dangerous Failure on Demand |
| PFH | Average frequency of dangerous failure [h⁻¹] |
| PLA | Programmable Logic Array |
| PLC | Programmable logic controller |
| SAT | Site acceptance test |
| SC | Systematic capability |
| SFF | Safe failure fraction |
| SIF | Safety instrumented function |
| SIL | Safety integrity level |
| SIS | Safety instrumented system |
| SRS | Safety requirement specification |
| UON | Unless otherwise noted |
| λs or λsafe | Failure rate of all safe failures |
| λd or λdangerous | Failure rate of all dangerous failures |
| λdd | Failure rate of all dangerous detected failures |
| λdu | Failure rate of all dangerous undetected failures |
| λsu | Failure rate of all safe undetected failures |
| λsd | Failure rate of all safe detected failures |
MTL Instruments in Vietnam
Viet Thang Loi Technology Company Limited (VTL TECH)
19A Cong Hoa, Bay Hien Ward, Ho Chi Minh City
Tel: (028) 3811 0510 / 11 · Fax: (028) 3811 0512
Email: info@vtltech.com.vn
For technical advice on SIL, MTL intrinsic safety and surge protection: