Functional safety of electrical/electronic/programmable electronic safety-related systems―Part 6:Guidelines on the application of GB/T 20438.2 and GB/T 20438.3
GB/T 20438 consists of seven parts under the general title of Functional safety of electrical/electronic/programmable electronic safety-related systems:
——Part 1: General requirements;
——Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems;
——Part 3: Software requirements;
——Part 4: Definitions and abbreviations;
——Part 5: Examples of methods for the determination of safety integrity levels;
——Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3;
——Part 7: Overview of techniques and measures.
This is Part 6 of GB/T 20438.
This part is developed in accordance with the rules given in GB/T 1.1-2009.
This part replaces GB/T 20438.6-2006 Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3 and the following main technical changes have been made with respect to GB/T 20438.6-2006:
——The techniques for evaluating the probabilities of hardware failure, such as fault tree, Markov model and Petri net, are added (see Annex B);
——The methodology for common cause failure factor of different structures is added (see D.7).
This part, by means of translation, is identical to IEC 61508-6:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3.
The following editorial changes have been made in this part:
——The standard has been renamed as Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3 so as to be consistent with the existing standard series.
This part was proposed by the China Machinery Industry Federation.
This part is under the jurisdiction of SAC/TC 124 National Technical Committee on Industrial Process Measurement and Control of Standardization Administration of China.
The previous edition of this part is as follow:
——GB/T 20438.6-2006.
Introduction
Systems comprised of electrical and/or electronic elements have been used for many years to perform safety functions in most application sectors. Computer-based systems (generically referred to as programmable electronic systems) are being used in all application sectors to perform non-safety functions and, increasingly, to perform safety functions. If computer system technology is to be effectively and safely exploited, it is essential that those responsible for making decisions have sufficient guidance on the safety aspects on which to make these decisions.
GB/T 20438 sets out a generic approach for all safety lifecycle activities for systems comprised of electrical and/or electronic and/or programmable electronic (E/E/PE) elements that are used to perform safety functions. This unified approach has been adopted in order that a rational and consistent technical policy be developed for all electrically-based safety-related systems. A major objective is to facilitate the development of product and application sector standards based on the GB/T 20438 series.
Note 1: Examples of product and application sector standards based on the GB/T 20438 series are given in the Bibliography (see references [1], [2] and [3]).
In most situations, safety is achieved by a number of systems which rely on many technologies (for example mechanical, hydraulic, pneumatic, electrical, electronic, programmable electronic). Any safety strategy must therefore consider not only all the elements within an individual system (for example sensors, controlling devices and actuators) but also all the safety-related systems making up the total combination of safety-related systems. Therefore, while GB/T 20438 is concerned with E/E/PE safety-related systems, it may also provide a framework within which safety-related systems based on other technologies may be considered.
It is recognized that there is a great variety of applications using E/E/PE safety-related systems in a variety of application sectors and covering a wide range of complexity, hazard and risk potentials. In any particular application, the required safety measures will be dependent on many factors specific to the application. GB/T 20438, by being generic, will enable such measures to be formulated in future product and application sector standards and in revisions of those that already exist.
GB/T 20438
——considers all relevant overall, E/E/PE system and software safety lifecycle phases (for example, from initial concept, thorough design, implementation, operation and maintenance to decommissioning) when E/E/PE systems are used to perform safety functions;
——has been conceived with a rapidly developing technology in mind; the framework is sufficiently robust and comprehensive to cater for future developments;
——enables product and application sector standards, dealing with E/E/PE safety-related systems, to be developed; the development of product and application sector standards, within the framework of GB/T 20438, should lead to a high level of consistency (for example, of underlying principles, terminology etc.) both within application sectors and across application sectors; this will have both safety and economic benefits;
——provides a method for the development of the safety requirements specification necessary to achieve the required functional safety for E/E/PE safety-related systems;
——adopts a risk-based approach by which the safety integrity requirements can be determined;
——introduces safety integrity levels for specifying the target level of safety integrity for the safety functions to be implemented by the E/E/PE safety-related systems;
Note 2: GB/T 20438 does not specify the safety integrity level requirements for any safety function, nor does it mandate how the safety integrity level is determined. Instead it provides a risk-based conceptual framework and example techniques.
——sets target failure measures for safety functions carried out by E/E/PE safety-related systems, which are linked to the safety integrity levels;
——sets a lower limit on the target failure measures for a safety function carried out by a single E/E/PE safety-related system. For E/E/PE safety-related systems operating in:
——a low demand mode of operation, the lower limit is set at an average probability of a dangerous failure on demand of 10-5;
——a high demand or a continuous mode of operation, the lower limit is set at an average frequency of a dangerous failure of 10-9/h.
Note 3: A single E/E/PE safety-related system does not necessarily mean a single-channel architecture.
Note 4: It may be possible to achieve designs of safety-related systems with lower values for the target safety integrity for non-complex systems, but these limits are considered to represent what can be achieved for relatively complex systems (for example programmable electronic safety-related systems) at the present time.
——sets requirements for the avoidance and control of systematic faults, which are based on experience and judgement from practical experience gained in industry. Even though the probability of occurrence of systematic failures cannot in general be quantified GB/T 20438 does, however, allow a claim to be made, for a specified safety function, that the target failure measure associated with the safety function can be considered to be achieved if all the requirements in the standard have been met;
——introduces systematic capability which applies to an element with respect to its confidence that the systematic safety integrity meets the requirements of the specified safety integrity level;
——adopts a broad range of principles, techniques and measures to achieve functional safety for E/E/PE safety-related systems, but does not explicitly use the concept of fail safe. However, the concepts of “fail safe” and “inherently safe” principles may be applicable and adoption of such concepts is acceptable providing the requirements of the relevant clauses in the standard are met.
Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 6: Guidelines on the application of GB/T 20438.2 and GB/T 20438.3
1 Scope
1.1 This part of GB/T 20438 contains information and guidelines on GB/T 20438.2 and GB/T 20438.3.
——Annex A gives a brief overview of the requirements of GB/T 20438.2 and GB/T 20438.3 and sets out the functional steps in their application.
——Annex B gives an example technique for calculating the probabilities of hardware failure and shall be read in conjunction with 7.4.3 and Annex C of GB/T 20438.2-2017 and Annex D.
——Annex C gives a worked example of calculating diagnostic coverage and shall be read in conjunction with Annex C of GB/T 20438.2-2017.
——Annex D gives a methodology for quantifying the effect of hardware-related common cause failures on the probability of failure.
——Annex E gives worked examples of the application of the software safety integrity tables specified in Annex A of GB/T 20438.3-2017 for safety integrity levels 2 and 3.
1.2 GB/T 20438.1, GB/T 20438.2, GB/T 20438.3 and GB/T 20438.4 are basic safety publications, although this status does not apply in the context of low complexity E/E/PE safety-related systems (see 3.4.3 of GB/T 20438.4-2017). As basic safety publications, they are intended for use by technical committees in the preparation of standards in accordance with the principles contained in IEC Guide 104 and ISO/IEC Guide 51. GB/T 20438.1, GB/T 20438.2, GB/T 20438.3 and GB/T 20438.4 are also intended for use as stand-alone standards. The horizontal safety function of GB/T 20438 does not apply to medical equipment in compliance with the IEC 60601 series.
1.3 One of the responsibilities of a technical committee is, wherever applicable, to make use of basic safety publications in the preparation of its publications. In this context, the requirements, test methods or test conditions of this basic safety publication will not apply unless specifically referred to or included in the publications prepared by those technical committees.
1.4 Figure 1 shows the overall framework of the GB/T 20438 series and indicates the role that this part plays in the achievement of functional safety for E/E/PE safety-related systems.
Figure 1 Overall framework of the GB/T 20438 series
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
GB/T 20438.2-2017 Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems (IEC 61805-2:2010, IDT)
GB/T 20438.3-2017 Functional safety of electrical/ electronic/ programmable electronic safety-related systems - Part 3: Software requirements (IEC 61508-3:2010, IDT)
GB/T 20438.4-2017 Functional safety of electrical/ electronic/ programmable electronic safety-related systems – Part 4: Definitions and abbreviations (IEC 61508-4:2010, IDT)
3 Definitions and abbreviations
For the purposes of this document, the definitions and abbreviations given in GB/T 20438.4-2017 apply.
Annex A
(Informative)
Application of GB/T 20438.2 and GB/T 20438.3
A.1 General
Machinery, process plant and other equipment may, in the case of malfunction (for example by failures of electrical, electronic and/or programmable electronic devices), present risks to people and the environment from hazardous events such as fires, explosions, radiation overdoses, machinery traps, etc. Failures can arise from either physical faults in the device (for example causing random hardware failures), or from systematic faults (for example human errors made in the specification and design of a system cause systematic failure under some particular combination of inputs), or from some environmental condition.
GB/T 20438.1 provides an overall framework based on a risk approach for the prevention and/or control of failures in electro-mechanical, electronic, or programmable electronic devices.
The overall goal is to ensure that plant and equipment can be safely automated. A key objective of GB/T 20438 is to prevent:
——failures of control systems triggering other events, which in turn could lead to danger (for example fire, release of toxic materials, repeat stroke of a machine, etc.); and
——undetected failures in protection systems (for example in an emergency shut-down system), making the systems unavailable when needed for a safety action.
GB/T 20438.1 requires that a hazard and risk analysis at the process/machine level is carried out to determine the amount of risk reduction necessary to meet the risk criteria for the application. Risk is based on the assessment of both the consequence (or severity) and the frequency (or probability) of the hazardous event.
GB/T 20438.1 further requires that the amount of risk reduction established by the risk analysis is used to determine if one or more safety-related systems are required and what safety functions (each with a specified safety integrity ) they are needed for.
Foreword I
Introduction III
1 Scope
2 Normative references
3 Definitions and abbreviations
Annex A (Informative) Application of GB/T 20438.2 and GB/T 204
Annex B (Informative) Example of technique for evaluating probabilities of hardware failure
Annex C (Informative) Calculation of diagnostic coverage and safe failure fraction
Annex D (Informative) A methodology for quantifying the effect of hardware-related common cause failures in E/E/PE systems
Annex E (Informative) Example applications of software safety integrity tables of GB/T 204
Bibliography
Figure 1 Overall framework of the GB/T 20438 series
Figure A.1 Application of GB/T 204
Figure A.2 Application of GB/T 20438.2 (Figure A.1 continued)
Figure A.3 Application of GB/T 204
Figure B.1 Reliability block diagram of a whole safety loop
Figure B.2 Example configuration for two sensor channels
Figure B.3 Subsystem structure
Figure B.4 1oo1 physical block diagram
Figure B.5 1oo1 reliability block diagram
Figure B.6 1oo2 physical block diagram
Figure B.7 1oo2 reliability block diagram
Figure B.8 2oo2 physical block diagram
Figure B.9 2oo2 reliability block diagram
Figure B.10 1oo2D physical block diagram
Figure B.11 1oo2D reliability block diagram
Figure B.12 2oo3 physical block diagram
Figure B.13 2oo3 reliability block diagram
Figure B.14 Architecture of an example for low demand mode of operation
Figure B.15 Architecture of an example for high demand or continuous mode of operation
Figure B.16 Reliability block diagram of a simple whole loop with sensors organised into 2oo3 logic
Figure B.17 Simple fault tree equivalent to the reliability block diagram presented on Figure B
Figure B.18 Equivalence fault tree/reliability block diagram
Figure B.19 Instantaneous unavailability U(t) of single periodically tested components
Figure B.20 Principle of PFDavg calculations when using fault trees
Figure B.21 Effect of staggering the tests
Figure B.22 Example of complex testing pattern
Figure B.23 Markov graph modelling the behaviour of a two component system
Figure B.24 Principle of the multiphase Markovian modelling
Figure B.25 Saw-tooth curve obtained by multiphase Markovian approach
Figure B.26 Approximated Markovian model
Figure B.27 Impact of failures due to the demand itself
Figure B.28 Modelling of the impact of test duration
Figure B.29 Multiphase Markovian model with both DD and DU failures
Figure B.30 Changing logic (2oo3 to 1oo2) instead of repairing first failure
Figure B.31 "Reliability" Markov graphs with an absorbing state
Figure B.32 "Availability" Markov graphs without absorbing states
Figure B.33 Petri net for modelling a single periodically tested component
Figure B.34 Petri net to model common cause failure and repair resources
Figure B.35 Using reliability block diagrams to build Petri net and auxiliary Petri net for PFD and PFH calculations
Figure B.36 Simple Petri net for a single component with revealed failures and repairs
Figure B.37 Example of functional and dysfunctional modelling with a formal language
Figure B.38 Uncertainty propagation principle
Figure D.1 Relationship of common cause failures to the failures of individual channels
Figure D.2 Implementing shock model with fault trees
Table B.1 Terms and their ranges used in this annex (applies to 1oo1, 1oo2, 2oo2, 1oo2D, 1oo3 and 2oo3)
Table B.2 Average probability of failure on demand for a proof test interval of six months and a mean time to restoration of 8h
Table B.3 Average probability of failure on demand for a proof test interval of one year and mean time to restoration of 8h
Table B.4 Average probability of failure on demand for a proof test interval of two years and a mean time to restoration of 8h
Table B.5 Average probability of failure on demand for a proof test interval of ten years and a mean time to restoration of 8h
Table B.6 Average probability of failure on demand for the sensor subsystem in the example for low demand mode of operation (one year proof test interval and 8h MTTR)
Table B.7 Average probability of failure on demand for the logic subsystem in the example for low demand mode of operation (one year proof test interval and 8h MTTR)
Table B.8 Average probability of failure on demand for the final element subsystem in the example for low demand mode of operation (one year proof test interval and 8h MTTR)
Table B.9 Example for a non-perfect proof test
Table B.10 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of one month and a mean time to restoration of 8h
Table B.11 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of three months and a mean time to restoration of 8h
Table B.12 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of six months and a mean time to restoration of 8h
Table B.13 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of one year and a mean time to restoration of 8h
Table B.14 Average frequency of a dangerous failure for the sensor subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8h MTTR)
Table B.15 Average frequency of a dangerous failure for the logic subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8h MTTR)
Table B.16 Average frequency of a dangerous failure for the final element subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8h MTTR)
Table C.1 Example calculations for diagnostic coverage and safe failure fraction
Table C.2 Diagnostic coverage and effectiveness for different elements
Table D.1 Scoring programmable electronics or sensors/final elements
Table D.2 Value of Z: programmable electronics
Table D.3 Value of Z: sensors or final elements
Table D.4 Calculation of βint or βDint
Table D.5 Calculation of β for systems with levels of redundancy greater than 1oo
Table D.6 Example values for programmable electronics
Table E.1 Software safety requirements specification
Table E.2 Software design and development: software architecture design
Table E.3 Software design and development: support tools and programming language
Table E.4 Software design and development: detailed design
Table E.5 Software design and development: software module testing and integration
Table E.6 Programmable electronics integration (hardware and software)
Table E.7 Software aspects of system safety validation
Table E.8 Software modification
Table E.9 Software verification
Table E.10 Functional safety assessment
Table E.11 Software safety requirements specification
Table E.12 Software design and development: software architecture design
Table E.13 Software design and development: support tools and programming language
Table E.14 Software design and development: detailed design
Table E.15 Software design and development: software module testing and integration
Table E.16 Programmable electronics integration (hardware and software)
Table E.17 Software aspects of system safety validation
Table E.18 Modification
Table E.19 Software verification
Table E.20 Functional safety assessment
