标准编号:	GB/T 20438.6-2017
中文名称:	电气/电子/可编程电子安全相关系统的功能安全 第6部分：GB/T 20438.2和GB/T 20438.3的应用指南
英文名称:	Functional safety of electrical/electronic/programmable electronic safety-related systems―Part 6:Guidelines on the application of GB/T 20438.2 and GB/T 20438.3
中标分类:	N10    工业自动化与控制装置综合
行业分类:	GB    国家标准
ICS分类:	25.040 25.040    工业自动化系统 25.040
发布机构:	中华人民共和国国家质量监督检验检疫总局 中国国家标准化管理委员会
发布日期:	2017-12-29
实施日期:	2018-7-1
标准状态:	现行
替代旧标准:	GB/T 20438.6-2006 电气/电子/可编程电子安全相关系统的功能安全 第6部分: GB/T 20438.2 和GB/T 20438.3 的应用指南
翻译语言:	英文
文件格式:	PDF
中文字符数:	93000 字
翻译价格(元):	4550.00 元
交付时间:	付款后 1 个工作日

GB/T 20438 consists of seven parts under the general title of Functional safety of electrical/electronic/programmable electronic safety-related systems:



——Part 1: General requirements;



——Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems;



——Part 3: Software requirements;



——Part 4: Definitions and abbreviations;



——Part 5: Examples of methods for the determination of safety integrity levels;



——Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3;



——Part 7: Overview of techniques and measures.



This is Part 6 of GB/T 20438.



This part is developed in accordance with the rules given in GB/T 1.1-2009.



This part replaces GB/T 20438.6-2006 Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3 and the following main technical changes have been made with respect to GB/T 20438.6-2006:



——The techniques for evaluating the probabilities of hardware failure, such as fault tree, Markov model and Petri net, are added (see Annex B);



——The methodology for common cause failure factor of different structures is added (see D.7).



This part, by means of translation, is identical to IEC 61508-6:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3.



 

The following editorial changes have been made in this part:



——The standard has been renamed as Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3 so as to be consistent with the existing standard series.



This part was proposed by the China Machinery Industry Federation.



This part is under the jurisdiction of SAC/TC 124 National Technical Committee on Industrial Process Measurement and Control of Standardization Administration of China.



The previous edition of this part is as follow:



——GB/T 20438.6-2006.



 

Introduction



Systems comprised of electrical and/or electronic elements have been used for many years to perform safety functions in most application sectors. Computer-based systems (generically referred to as programmable electronic systems) are being used in all application sectors to perform non-safety functions and, increasingly, to perform safety functions. If computer system technology is to be effectively and safely exploited, it is essential that those responsible for making decisions have sufficient guidance on the safety aspects on which to make these decisions.



GB/T 20438 sets out a generic approach for all safety lifecycle activities for systems comprised of electrical and/or electronic and/or programmable electronic (E/E/PE) elements that are used to perform safety functions. This unified approach has been adopted in order that a rational and consistent technical policy be developed for all electrically-based safety-related systems. A major objective is to facilitate the development of product and application sector standards based on the GB/T 20438 series.



Note 1: Examples of product and application sector standards based on the GB/T 20438 series are given in the Bibliography (see references [1], [2] and [3]).



In most situations, safety is achieved by a number of systems which rely on many technologies (for example mechanical, hydraulic, pneumatic, electrical, electronic, programmable electronic). Any safety strategy must therefore consider not only all the elements within an individual system (for example sensors, controlling devices and actuators) but also all the safety-related systems making up the total combination of safety-related systems. Therefore, while GB/T 20438 is concerned with E/E/PE safety-related systems, it may also provide a framework within which safety-related systems based on other technologies may be considered.



It is recognized that there is a great variety of applications using E/E/PE safety-related systems in a variety of application sectors and covering a wide range of complexity, hazard and risk potentials. In any particular application, the required safety measures will be dependent on many factors specific to the application. GB/T 20438, by being generic, will enable such measures to be formulated in future product and application sector standards and in revisions of those that already exist.



GB/T 20438



——considers all relevant overall, E/E/PE system and software safety lifecycle phases (for example, from initial concept, thorough design, implementation, operation and maintenance to decommissioning) when E/E/PE systems are used to perform safety functions;



——has been conceived with a rapidly developing technology in mind; the framework is sufficiently robust and comprehensive to cater for future developments;



——enables product and application sector standards, dealing with E/E/PE safety-related systems, to be developed; the development of product and application sector standards, within the framework of GB/T 20438, should lead to a high level of consistency (for example, of underlying principles, terminology etc.) both within application sectors and across application sectors; this will have both safety and economic benefits;



——provides a method for the development of the safety requirements specification necessary to achieve the required functional safety for E/E/PE safety-related systems;



——adopts a risk-based approach by which the safety integrity requirements can be determined;



——introduces safety integrity levels for specifying the target level of safety integrity for the safety functions to be implemented by the E/E/PE safety-related systems;



Note 2: GB/T 20438 does not specify the safety integrity level requirements for any safety function, nor does it mandate how the safety integrity level is determined. Instead it provides a risk-based conceptual framework and example techniques.



——sets target failure measures for safety functions carried out by E/E/PE safety-related systems, which are linked to the safety integrity levels;



——sets a lower limit on the target failure measures for a safety function carried out by a single E/E/PE safety-related system. For E/E/PE safety-related systems operating in:



——a low demand mode of operation, the lower limit is set at an average probability of a dangerous failure on demand of 10-5;



——a high demand or a continuous mode of operation, the lower limit is set at an average frequency of a dangerous failure of 10-9/h.



Note 3: A single E/E/PE safety-related system does not necessarily mean a single-channel architecture.



Note 4: It may be possible to achieve designs of safety-related systems with lower values for the target safety integrity for non-complex systems, but these limits are considered to represent what can be achieved for relatively complex systems (for example programmable electronic safety-related systems) at the present time.

 

——sets requirements for the avoidance and control of systematic faults, which are based on experience and judgement from practical experience gained in industry. Even though the probability of occurrence of systematic failures cannot in general be quantified GB/T 20438 does, however, allow a claim to be made, for a specified safety function, that the target failure measure associated with the safety function can be considered to be achieved if all the requirements in the standard have been met;



——introduces systematic capability which applies to an element with respect to its confidence that the systematic safety integrity meets the requirements of the specified safety integrity level;



——adopts a broad range of principles, techniques and measures to achieve functional safety for E/E/PE safety-related systems, but does not explicitly use the concept of fail safe. However, the concepts of “fail safe” and “inherently safe” principles may be applicable and adoption of such concepts is acceptable providing the requirements of the relevant clauses in the standard are met.





Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3



1 Scope



1.1 This part of GB/T 20438 contains information and guidelines on GB/T 20438.2 and GB/T 20438.3.



——Annex A gives a brief overview of the requirements of GB/T 20438.2 and GB/T 20438.3 and sets out the functional steps in their application.



——Annex B gives an example technique for calculating the probabilities of hardware failure and shall be read in conjunction with 7.4.3 and Annex C of GB/T 20438.2-2017 and Annex D.



——Annex C gives a worked example of calculating diagnostic coverage and shall be read in conjunction with Annex C of GB/T 20438.2-2017.



——Annex D gives a methodology for quantifying the effect of hardware-related common cause failures on the probability of failure.



——Annex E gives worked examples of the application of the software safety integrity tables specified in Annex A of GB/T 20438.3-2017 for safety integrity levels 2 and 3.



1.2 GB/T 20438.1, GB/T 20438.2, GB/T 20438.3 and GB/T 20438.4 are basic safety publications, although this status does not apply in the context of low complexity E/E/PE safety-related systems (see 3.4.3 of GB/T 20438.4-2017). As basic safety publications, they are intended for use by technical committees in the preparation of standards in accordance with the principles contained in IEC Guide 104 and ISO/IEC Guide 51. GB/T 20438.1, GB/T 20438.2, GB/T 20438.3 and GB/T 20438.4 are also intended for use as stand-alone standards. The horizontal safety function of GB/T 20438 does not apply to medical equipment in compliance with the IEC 60601 series.



1.3 One of the responsibilities of a technical committee is, wherever applicable, to make use of basic safety publications in the preparation of its publications. In this context, the requirements, test methods or test conditions of this basic safety publication will not apply unless specifically referred to or included in the publications prepared by those technical committees.

1.4 Figure 1 shows the overall framework of the GB/T 20438 series and indicates the role that this part plays in the achievement of functional safety for E/E/PE safety-related systems.





Figure 1 Overall framework of the GB/T 20438 series



2 Normative references



The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.



GB/T 20438.2-2017 Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems (IEC 61805-2:2010, IDT)

GB/T 20438.3-2017 Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 3: Software requirements (IEC 61508-3:2010, IDT)

GB/T 20438.4-2017 Functional safety of electrical/ electronic/ programmable electronic safety-related systems – Part 4: Definitions and abbreviations (IEC 61508-4:2010, IDT)



3 Definitions and abbreviations



For the purposes of this document, the definitions and abbreviations given in GB/T 20438.4-2017 apply.



 

Annex A

(Informative)

Application of GB/T 20438.2 and GB/T 20438.3



A.1 General



Machinery, process plant and other equipment may, in the case of malfunction (for example by failures of electrical, electronic and/or programmable electronic devices), present risks to people and the environment from hazardous events such as fires, explosions, radiation overdoses, machinery traps, etc. Failures can arise from either physical faults in the device (for example causing random hardware failures), or from systematic faults (for example human errors made in the specification and design of a system cause systematic failure under some particular combination of inputs), or from some environmental condition.



GB/T 20438.1 provides an overall framework based on a risk approach for the prevention and/or control of failures in electro-mechanical, electronic, or programmable electronic devices.



The overall goal is to ensure that plant and equipment can be safely automated. A key objective of GB/T 20438 is to prevent:



——failures of control systems triggering other events, which in turn could lead to danger (for example fire, release of toxic materials, repeat stroke of a machine, etc.); and



——undetected failures in protection systems (for example in an emergency shut-down system), making the systems unavailable when needed for a safety action.



GB/T 20438.1 requires that a hazard and risk analysis at the process/machine level is carried out to determine the amount of risk reduction necessary to meet the risk criteria for the application. Risk is based on the assessment of both the consequence (or severity) and the frequency (or probability) of the hazardous event.



GB/T 20438.1 further requires that the amount of risk reduction established by the risk analysis is used to determine if one or more safety-related systems are required and what safety functions (each with a specified safety integrity ) they are needed for.

Foreword I
Introduction III
1 Scope
2 Normative references
3 Definitions and abbreviations
Annex A (Informative) Application of GB/T 20438.2 and GB/T 204
Annex B (Informative) Example of technique for evaluating probabilities of hardware failure
Annex C (Informative) Calculation of diagnostic coverage and safe failure fraction
Annex D (Informative) A methodology for quantifying the effect of hardware-related common cause failures in E/E/PE systems
Annex E (Informative) Example applications of software safety integrity tables of GB/T 204
Bibliography
Figure 1 Overall framework of the GB/T 20438 series
Figure A.1 Application of GB/T 204
Figure A.2 Application of GB/T 20438.2 (Figure A.1 continued)
Figure A.3 Application of GB/T 204
Figure B.1 Reliability block diagram of a whole safety loop
Figure B.2 Example configuration for two sensor channels
Figure B.3 Subsystem structure
Figure B.4 1oo1 physical block diagram
Figure B.5 1oo1 reliability block diagram
Figure B.6 1oo2 physical block diagram
Figure B.7 1oo2 reliability block diagram
Figure B.8 2oo2 physical block diagram
Figure B.9 2oo2 reliability block diagram
Figure B.10 1oo2D physical block diagram
Figure B.11 1oo2D reliability block diagram
Figure B.12 2oo3 physical block diagram
Figure B.13 2oo3 reliability block diagram
Figure B.14 Architecture of an example for low demand mode of operation
Figure B.15 Architecture of an example for high demand or continuous mode of operation
Figure B.16 Reliability block diagram of a simple whole loop with sensors organised into 2oo3 logic
Figure B.17 Simple fault tree equivalent to the reliability block diagram presented on Figure B
Figure B.18 Equivalence fault tree/reliability block diagram
Figure B.19 Instantaneous unavailability U(t) of single periodically tested components
Figure B.20 Principle of PFDavg calculations when using fault trees
Figure B.21 Effect of staggering the tests
Figure B.22 Example of complex testing pattern
Figure B.23 Markov graph modelling the behaviour of a two component system
Figure B.24 Principle of the multiphase Markovian modelling
Figure B.25 Saw-tooth curve obtained by multiphase Markovian approach
Figure B.26 Approximated Markovian model
Figure B.27 Impact of failures due to the demand itself
Figure B.28 Modelling of the impact of test duration
Figure B.29 Multiphase Markovian model with both DD and DU failures
Figure B.30 Changing logic (2oo3 to 1oo2) instead of repairing first failure
Figure B.31 "Reliability" Markov graphs with an absorbing state
Figure B.32 "Availability" Markov graphs without absorbing states
Figure B.33 Petri net for modelling a single periodically tested component
Figure B.34 Petri net to model common cause failure and repair resources
Figure B.35 Using reliability block diagrams to build Petri net and auxiliary Petri net for PFD and PFH calculations
Figure B.36 Simple Petri net for a single component with revealed failures and repairs
Figure B.37 Example of functional and dysfunctional modelling with a formal language
Figure B.38 Uncertainty propagation principle
Figure D.1 Relationship of common cause failures to the failures of individual channels
Figure D.2 Implementing shock model with fault trees
Table B.1 Terms and their ranges used in this annex (applies to 1oo1, 1oo2, 2oo2, 1oo2D, 1oo3 and 2oo3)
Table B.2 Average probability of failure on demand for a proof test interval of six months and a mean time to restoration of 8h
Table B.3 Average probability of failure on demand for a proof test interval of one year and mean time to restoration of 8h
Table B.4 Average probability of failure on demand for a proof test interval of two years and a mean time to restoration of 8h
Table B.5 Average probability of failure on demand for a proof test interval of ten years and a mean time to restoration of 8h
Table B.6 Average probability of failure on demand for the sensor subsystem in the example for low demand mode of operation (one year proof test interval and 8h MTTR)
Table B.7 Average probability of failure on demand for the logic subsystem in the example for low demand mode of operation (one year proof test interval and 8h MTTR)
Table B.8 Average probability of failure on demand for the final element subsystem in the example for low demand mode of operation (one year proof test interval and 8h MTTR)
Table B.9 Example for a non-perfect proof test
Table B.10 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of one month and a mean time to restoration of 8h
Table B.11 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of three months and a mean time to restoration of 8h
Table B.12 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of six months and a mean time to restoration of 8h
Table B.13 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of one year and a mean time to restoration of 8h
Table B.14 Average frequency of a dangerous failure for the sensor subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8h MTTR)
Table B.15 Average frequency of a dangerous failure for the logic subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8h MTTR)
Table B.16 Average frequency of a dangerous failure for the final element subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8h MTTR)
Table C.1 Example calculations for diagnostic coverage and safe failure fraction
Table C.2 Diagnostic coverage and effectiveness for different elements
Table D.1 Scoring programmable electronics or sensors/final elements
Table D.2 Value of Z: programmable electronics
Table D.3 Value of Z: sensors or final elements
Table D.4 Calculation of βint or βDint
Table D.5 Calculation of β for systems with levels of redundancy greater than 1oo
Table D.6 Example values for programmable electronics
Table E.1 Software safety requirements specification
Table E.2 Software design and development: software architecture design
Table E.3 Software design and development: support tools and programming language
Table E.4 Software design and development: detailed design
Table E.5 Software design and development: software module testing and integration
Table E.6 Programmable electronics integration (hardware and software)
Table E.7 Software aspects of system safety validation
Table E.8 Software modification
Table E.9 Software verification
Table E.10 Functional safety assessment
Table E.11 Software safety requirements specification
Table E.12 Software design and development: software architecture design
Table E.13 Software design and development: support tools and programming language
Table E.14 Software design and development: detailed design
Table E.15 Software design and development: software module testing and integration
Table E.16 Programmable electronics integration (hardware and software)
Table E.17 Software aspects of system safety validation
Table E.18 Modification
Table E.19 Software verification
Table E.20 Functional safety assessment

电气/电子/可编程电子安全相关系统的
功能安全 第6部分：GB/T 20438.2和
GB/T 20438.3的应用指南
1范围
1.1 GB/T 20438的本部分包括GB/T 20438.2与GB/T 20438.3的信息以及指南。
——附录A中阐述了GB/T 20438.2及GB/T 20438.3的要求简述，以及应用中的功能步骤。
——附录B列举了如何计算硬件失效概率。阅读时要结合GB/T 20438.2—2017的7.4.3、附录C和本部分的附录D。
——附录C给出了诊断覆盖率的计算示例，阅读时要结合GB/T 20438.2—2017的附录C。
——附录D阐述了将硬件共因失效率量化的方法。
——附录E给出了GB/T 20438.3—2017附录A中规定的在安全完整性等级2和3时软件安全完整性表的应用示例。
1.2 GB/T 20438.1、GB/T 20438.2、GB/T 20438.3和GB/T 20438.4是基础的安全标准，虽然它不适用于低复杂的E/E/PE安全相关系统(见GB/T 20438.4—2017的3.4.3)，但作为基础安全标准，各技术委员会可以在IEC指南104和ISO/IEC指南51的指导下制定相关标准时使用。GB/T 20438.1、GB/T 20438.2、GB/T 20438.3和GB/T 20438.4也可作为独立标准来使用。GB/T 20438的横向安全功能不适用于在IEC 60601系列指导下的医疗设备。
1.3技术委员会的职责之一就是只要合适，在制定其标准时都应使用基础安全标准。也就是说，本基础安全标准涉及的要求、测试方法或测试条件，只有在相关技术委员会制定标准时加以引用或包含时才能得到应用。
1.4图1表示了GB/T 20438的整体框架，同时明确了本部分在实现E/E/PE安全相关系统功能安全过程中的作用。

技术要求
第1部分
编制整体安全要求(概念、范围、定义、危险和风险分析)
7.1～7.5
第1部分
将安全要求分配给E/E/PE安全相关系统
7.6
第1部分
E/E/PE安全相关系统的系统安全要求规范
7.10
第2部分
E/E/PE安全相关系统的实现阶段
第3部分
安全相关软件的实现阶段
第1部分
E/E/PE安全相关系统的安装、调试和安全确认
7.13和7.14
第1部分
E/E/PE安全相关系统的操作、维护、修理、修改和改型、退役或处置
7.15～7.17
第5部分
确定安全完整性等级的方法示例
第6部分
第2部分和第3部分的应用指南
第7部分
技术和措施概述
其他要求
第4部分
定义和缩略语
第1部分
文档
第5章和附录A
第1部分
功能安全的管理
第6章
第1部分
功能安全评估
第8章
图1 GB/T 20438的整体框架
2规范性引用文件
下列文件对于本文件的应用是必不可少的。凡是注日期的引用文件，仅注日期的版本适用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改单)适用于本文件。
GB/T 20438.2—2017 电气/电子/可编程电子安全相关系统的功能安全 第2部分：电气/电子/可编程电子安全相关系统的要求(IEC 61805-2：2010，IDT)
GB/T 20438.3—2017电气/电子/可编程电子安全相关系统的功能安全 第3部分：软件要求(IEC 61508-3：2010，IDT)
GB/T 20438.4—2017 电气/电子/可编程电子安全相关系统的功能安全 第4部分：定义和缩略语(IEC 61508-4：2010，IDT)
3定义和缩略语
GB/T 20438.4—2017界定的定义和缩略语适用于本文件。
附录A
(资料性附录)
GB/T 20438.2和GB/T 20438.3的应用
A.1概述
机械、工艺装置以及其他设备在工作不正常的情况下(例如电气、电子或可编程电子设备的失效)有可能产生诸如火灾、爆炸、辐射超剂量、机械卷入等危险事件，对人员和环境产生一定风险。失效既可能因设备的物理故障(如引起随机硬件失效)，也可能因为系统性故障(如在系统的设计和规范中的人为错误在一些特别输入组合的情况下导致的系统性失效)或者因为某个环境条件而产生。
GB/T 20438.1提供了一个基于风险方法的整体框架，用于防止和/或控制机电、电子或者可编程电子设备中的失效。
GB/T 20438的总目标就是确保装置和设备安全地自动运行，其中关键目标就是防止：
——控制系统性失效触发其他事件，继而可能导致(火灾、有毒物质泄漏、机械设备反复冲击等)危险；以及
——保护系统(如紧急停车系统)中未检测到的失效，这些失效使系统不能在需要时正常执行安全动作。
GB/T 20438.1要求在过程或机器级执行一次危险和风险分析，从而确定在应用中满足风险准则所必需的风险降低量。风险基于对危险事件的后果(或严重性)和频率(或概率)的评估。
GB/T 20438.1进一步要求由风险分析得到的风险降低量，来确定是否需要一个或几个安全相关系统1)以及它们需要什么样的安全功能(每个都有一个规定的安全完整性2))。
GB/T 20438.2和GB/T 20438.3涉及了GB/T 20438.1分配给任意一个被指定为E/E/PE安全相关系统的安全功能和安全完整性要求，并建立安全生命周期活动的要求，这些要求：
——将在硬件及软件的规范、设计、修改中使用；并且
——重点是防止和/或控制随机硬件失效和系统性失效(E/E/PE系统和软件安全生命周期3))。
GB/T 20438.2和GB/T 20438.3并没有给出针对指定的可容忍风险要求，哪一级安全完整性合适的指南。这取决于多种因素，包括应用的类别、其他系统执行安全功能的程度及社会、经济因素等(见GB/T 20438.1及GB/T 20438.5)。
GB/T 20438.2与GB/T 20438.3的要求包括：
——措施与技术的应用4)，这些措施与技术可按安全完整性进行分级，作为预防性方法用于避免系统性失效5)。
1)功能安全所需要的系统包含一个或多个电气(机电)、电子、可编程电子(E/E/PE)设备的系统被指定为E/E/PE安全相关系统，还包括所有执行安全功能所必需的设备(见GB/T 20438.4—2017的3.4.1)。
2)安全完整性规定为四个不同的等级。安全完整性等级4为最高，安全完整性等级1为最低(见GB/T 20438.1—2017的7.6.2.9)。
3)为了清晰地说明GB/T 20438的要求，使用一种开发过程模型，按照已定义好的、很少出现重复的顺序列要求进行排序(有时称为瀑布模型)。但是，值得强调的是：倘若在工程项目中安全计划能给出一种等价的陈述，就可以使用任何生命周期方案(见GB/T 20438.1—2017的第6章)。
4)在GB/T 20438.2—2017和GB/T 20438.3—2017的附录A和附录B的表中给出了每一个安全完整性等级所需的技术和措施。
5)系统性失效一般不能被量化，原因包括：在硬件和软件中存在规范和设计缺陷；考虑环境(如温度)引起的失效，以及操作相关的失误(如界面不友好)。
——利用故障检测、冗余和架构特性(如多样性)等设计特性来控制系统性失效(包括软件失效)和随机硬件失效。
在GB/T 20438.2中，对于危险随机硬件失效，保证安全完整性目标得以满足是基于：
——硬件故障裕度要求(见GB/T 20438.2—2017的表2、表3)；并且
——子系统与部件的诊断覆盖率和检验测试的频率，通过使用适当的数据执行一次可靠性分析。
在GB/T 20438.2与GB/T 20438.3中，满足系统性失效要求的安全完整性目标，可通过以下获得：
——正确应用安全管理规程；
——任用合格的人员；
——应用规定的安全生命周期活动，包括规定的技术和措施6)；
——独立的功能安全评估7)。
总目标是要确保与安全完整性相应的残余系统性失误，不会导致E/E/PE安全相关系统的失效。
GB/T 20438.2为E/E/PE安全相关系统的硬件8)(包括传感器、最终元件)达到安全完整性提出要求。应使用技术和措施防止随机性硬件失效和系统性硬件失效。如上所述，它们包括适当的措施以避免故障和控制失效。对于功能安全需要人员动作的情况，给出了操作员界面的要求。在GB/T 20438.2中还规定了用于检测随机硬件失效基于软件和硬件(例如多样性)的诊断测试技术和措施。
GB/T 20438.3为软件——嵌入式软件(包括诊断故障检测服务)和应用软件达到安全完整性提出要求。由于还不知道何种方法可证明适度复杂的安全相关软件中不存在故障，特别是不存在规范和设计故障，所以GB/T 20438.3需要故障避免(质量保证)和故障裕度方法的组合(软件架构)。GB/T 20438.3需要采用如下软件工程原则：自顶向下的设计、模块化、验证开发生命周期的每一个阶段、经验证的软件模块和软件模块库、便于验证和确认的清晰文档。不同级别的软件需要不同级别的保证，以确保这些以及相关原则得以正确应用。
软件开发者与整个E/E/PE系统的开发组织可独立也可不独立。无论哪种情况，密切协作都是必要的，特别是在可编程电子的架构开发中，需要从安全效果出发考虑硬件和软件架构之间的折中方案(见GB/T 20438.2—2017的图4)。
A.2 GB/T 20438.2应用中的功能步骤
GB/T 20438.2应用中的功能步骤如图A.1和图A.2所示，GB/T 20438.3应用中的功能步骤如图A.3所示。
GB/T 20438.2应用中的功能步骤(见图A.1和图A.2)如下所示：
a)获得安全要求的分配(见GB/T 20438.1)，在开发E/E/PE系统的过程中更新相应的安全计划编制。
b)对于每个安全功能，确定E/E/PE系统的安全要求，包括安全完整性要求(见GB/T 20438.2—2017的7.2)。给软件分配要求并提交给软件供应商和/或开发者以便应用GB/T 20438.3。
注1：在这一阶段需要考虑EUC控制系统和E/E/PE安全相关系统中同时发生失效的概率(见GB/T 20438.1—2017的7.5.2.4)。它们可能是由于例如受相似环境影响的共因失效的部件所引起。这种失效的存在会导致比预计中更高的残余风险，除非已对其作了适当的处理。
c)启动E/E/PE安全确认计划编制阶段(见GB/T 20438.2—2017的7.3)。
6)如果在编制安全计划过程中已将合理性证明归档，那么GB/T 20438中规定的那些措施可以被替代(见GB/T 20438.1—2017的第6章)。
7)独立评估不一定是第三方评估(见GB/T 20438.1—2017的第8章)。
8)包括固定的内置软件或软件等效物(也称为固件)，如专用集成电路。
d)规定E/E/PE逻辑子系统、传感器和最终元件的架构(配置)。与软件供应商/开发者一起复审硬件和软件架构以及硬件和软件之间折衷方案的安全影响(见GB/T 20438.2—2017的图4)。如果需要将重复此步骤。
e)开发E/E/PE安全相关系统硬件架构模型，通过分别检查每个安全功能来开发架构模型并确定用来执行这些功能的子系统(元器件)。
f)建立E/E/PE安全相关系统中使用的每个子系统(元器件)的系统参数。确定每个子系统(元器件)的：
——失效的检验测试时间间隔，这些失效是不会自动检测到的；
——平均恢复时间；
——诊断覆盖率(见GB/T 20438.2—2017的附录C)；
——失效概率；
——要求的架构约束；路径1H见GB/T 20438.2—2017的7.4.4.2和附录C，路径2H见GB/T 20438.2—2017的7.4.4.3。
g)为E/E/PE安全相关系统所要执行的每一个安全功能建立可靠性模型。
注2：可靠性模型是一个数学公式，用于表示与设备和使用条件有关的可靠性和相关参数之间的关系。
h)使用适当的技术计算每个安全功能的可靠性预测值，将上面b)项中确定的目标失效量结果同路径1H(见GB/T 20438.2—2017的7.4.4.2)或路径2H(见GB/T 20438.2—2017的7.4.4.3)的要求进行比较。如果预测的可靠性与目标失效量不同和/或不符合路径1H或路径2H的要求，则；
——在可能时改变一个或多个子系统参数(返回到上面的f))；和/或
——改变硬件架构(返回到上面的d))。
注3：有多种建模方法，分析人员宜选择最适合的方法(见附录B可使用方法的指南)
i)进行E/E/PE安全相关系统的设计。选择用于控制系统性硬件失效、受环境影响产生的失效和操作失效的技术和措施(见GB/T 20438.2—2017的附录A)。
j)在目标硬件上集成(见GB/T 20438.2—2017的7.5及附录B)经验证过的软件(见GB/T 20438.3)，同时为用户和维护人员制定系统操作规程(见GB/T 20438.2—2017的7.6及附录B)。包括软件方面(见附录A中A.3 f))。
k)与软件开发者(见GB/T 20438.3—2017的7.7)一起确认E/E/PE系统(见GB/T 20438.2—2017的7.7和附录B)。
1)把硬件和E/E/PE安全相关系统安全确认的结果移交给系统工程师，以便进一步集成到整个系统中。
m)如果在使用寿命期限内需要维护或修改E/E/PE安全相关系统，则将适当的重新采用GB/T 20438.2(见GB/T 20438.2—2017的7.8)。
用GB/T 20438.2(见GB/T 20438.2—2017的7.8)。在整个E/E/PE安全相关系统安全生命周期将开展一系列活动。它们包括验证(见GB/T 20438.2—2017的7.9)和功能安全评估(见GB/T 20438.1—2017的第8章)。
在应用上述步骤的时候，应选择E/E/PE安全相关系统适合于要求的安全完整性等级的技术和措施。为了帮助选择，已经编制好了一些表，针对4种安全完整性等级列出了各种技术和措施(见GB/T 20438.2—2017的附录B)。在进一步参考这些信息源时，交叉参考这些表可总览每种技术和措施(见GB/T 20438.7—2017的附录A和附录B)。
附录B提供了一种可行的计算E/E/PE安全相关系统硬件失效概率的技术。
注4：在应用上述步骤时如果在编制安全计划过程中已经建立合理性证明文档，那么GB/T 20438中规定的措施可以被替代(见GB/T 20438.1—2017的第6章)。

确定临界参数，选择并实现改进
见：
7.4.6避免系统性故障的要求
7.4.7控制系统性故障的要求
7.4.8检测到故障时的系统行为要求
7.4.9E/E/FE系统实现的要求
7.4.10经使用证明组件的要求
获得或产生安全分配描述
编制E/E/PE系统安全要求规范
开始编制E/E/PE安全相关系统安全确认计划
开发硬件架构模型
建立E/E/PE安全相关系统参数
为路径1H或路径2H确定安全参数
创立每个安全功能的可靠性模型
对于每种安全功能，确定E/E/PE安全相关系统能达到的目标失效措施概率
估算的安全功能的失效概率是否满足要求的失效量?
否
是
实现设计，选择用于控制系统失效的技术和措施
至图A.2中的“A”
见GB/T 20438.1-XXXX的7.6
见7.3
从图A.2中的“B”
见7.4.4.2的路线1H7.4.4.3的路线2H
见7.4.5量化随机硬件失效影响的要求
注：对于PE安全相关系统，软件活动将同时进行(见图A.3)。
图A.1 GB/T 20438.2的应用