wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Functional Safety 21-3
IEC 61508:2009
Generic
Def Stan 00-54 (UK)
MIL STD 882C (USA)
MIL STD 882D (USA)
DEF 5679 (AUS)
IEC 61800
Power drive
systems
Def Stan 00-56 (UK)
Military
Def Stan 00-55 (UK)
IEC 61508
IEC 61511 IEC 61513 ISO 26262:2011 IEC 62061
Process Nuclear power Automotive EN 13849-1
industry plants
CENELEC EN 50126
CENELEC EN 50128
CENELEC EN 50129
CENELEC EN 50159
Yellow Book (UK)
AREMA Standards (USA)
Railways
EN 954-1
Safety of
machinery
CAP 670 (UK)
RTCA DO-178C (USA)
EATMP (EU)
ESARRs (EU)
ARP4754 (USA)
RTCA DO-178B (USA)
ED12B (Europe)
RTCA DO-254 (USA)
RTCA DO-278 (USA)
ED109 (Europe)
Aircraft/air traffic control
NASA Standards
ESA Standards
... and many more ...
ACTIVE
CANCELLED
In work
FIGURE 21.1
Safety standards quagmire.
For our purposes, we will consider only one of the standards: IEC61508 [IEC61508]. This standard
is generic, i.e., it is not geared toward a specific application domain, but still it contains enough concrete
guidance to be useful. Several domains have derived domain-specific versions of this standard,
as can be seen in Figure 21.1. The principles of IEC61508 are reflected in all these domain-specific
extensions.
21.3.2 Basics of IEC61508
IEC61508 applies to electrical, electronic, programmable electronic safety-related systems. The general
assumption is that there is some equipment under control (EUC), which has an inherent risk. In
order to reduce this risk, a safety-related system controls the risk of the EUC. For example, in a factory,
some heavy machines may be the EUC. The uncontrolled EUC may pose a risk to the operator,
and a safety-related industrial communication system can be used to reduce the risk of this EUC.
The safety-related system must be functionally safe, i.e., it must function correctly, and shall not fail
in a dangerous way.
Depending on the necessary risk reduction, the safety-related
system is classified as being in one of four so-called safety integrity
levels (SILs). The SILs are defined in terms of accepted failure rates TABLE 21.1 Safety Integrity Levels
regarding dangerous failures per hour (see Table 21.1).
SIL Dangerous Failure per Hour
In a SIL1 system, it is accepted that the system fails in a dangerous
way less frequently than every 10 5 4 ≥10
h, whereas in a SIL4 system,
−9 to