1、 IEC 61508-6 Edition 2.0 2010-04 INTERNATIONAL STANDARD NORME INTERNATIONALE Functional safety of electrical/electronic/programmable electronic safety-related systems Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3 Scurit fonctionnelle des systmes lectriques/lectroniques/lectron
2、iques programmables relatifs la scurit Partie 6: Lignes directrices pour lapplication de la CEI 61508-2 et de la CEI 61508-3 IEC 61508-6:2010 THIS PUBLICATION IS COPYRIGHT PROTECTED Copyright 2010 IEC, Geneva, Switzerland All rights reserved. Unless otherwise specified, no part of this publication m
3、ay be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either IEC or IECs member National Committee in the country of the requester. If you have any questions about IEC copyright or have an enquiry
4、about obtaining additional rights to this publication, please contact the address below or your local IEC member National Committee for further information. Droits de reproduction rservs. Sauf indication contraire, aucune partie de cette publication ne peut tre reproduite ni utilise sous quelque for
5、me que ce soit et par aucun procd, lectronique ou mcanique, y compris la photocopie et les microfilms, sans laccord crit de la CEI ou du Comit national de la CEI du pays du demandeur. Si vous avez des questions sur le copyright de la CEI ou si vous dsirez obtenir des droits supplmentaires sur cette
6、publication, utilisez les coordonnes ci-aprs ou contactez le Comit national de la CEI de votre pays de rsidence. IEC Central Office 3, rue de Varemb CH-1211 Geneva 20 Switzerland Email: inmailiec.ch Web: www.iec.ch About the IEC The International Electrotechnical Commission (IEC) is the leading glob
7、al organization that prepares and publishes International Standards for all electrical, electronic and related technologies. About IEC publications The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the latest edition, a corrigenda or a
8、n amendment might have been published. Catalogue of IEC publications: www.iec.ch/searchpub The IEC on-line Catalogue enables you to search by a variety of criteria (reference number, text, technical committee,). It also gives information on projects, withdrawn and replaced publications. IEC Just Pub
9、lished: www.iec.ch/online_news/justpub Stay up to date on all new IEC publications. Just Published details twice a month all new publications released. Available on-line and also by email. Electropedia: www.electropedia.org The worlds leading online dictionary of electronic and electrical terms cont
10、aining more than 20 000 terms and definitions in English and French, with equivalent terms in additional languages. Also known as the International Electrotechnical Vocabulary online. Customer Service Centre: www.iec.ch/webstore/custserv If you wish to give us your feedback on this publication or ne
11、ed further assistance, please visit the Customer Service Centre FAQ or contact us: Email: csciec.ch Tel.: +41 22 919 02 11 Fax: +41 22 919 03 00 A propos de la CEI La Commission Electrotechnique Internationale (CEI) est la premire organisation mondiale qui labore et publie des normes internationales
12、 pour tout ce qui a trait llectricit, llectronique et aux technologies apparentes. A propos des publications CEI Le contenu technique des publications de la CEI est constamment revu. Veuillez vous assurer que vous possdez ldition la plus rcente, un corrigendum ou amendement peut avoir t publi. Catal
13、ogue des publications de la CEI: www.iec.ch/searchpub/cur_fut-f.htm Le Catalogue en-ligne de la CEI vous permet deffectuer des recherches en utilisant diffrents critres (numro de rfrence, texte, comit dtudes,). Il donne aussi des informations sur les projets et les publications retires ou remplaces.
14、 Just Published CEI: www.iec.ch/online_news/justpub Restez inform sur les nouvelles publications de la CEI. Just Published dtaille deux fois par mois les nouvelles publications parues. Disponible en-ligne et aussi par email. Electropedia: www.electropedia.org Le premier dictionnaire en ligne au mond
15、e de termes lectroniques et lectriques. Il contient plus de 20 000 termes et dfinitions en anglais et en franais, ainsi que les termes quivalents dans les langues additionnelles. Egalement appel Vocabulaire Electrotechnique International en ligne. Service Clients: www.iec.ch/webstore/custserv/custse
16、rv_entry-f.htm Si vous dsirez nous donner des commentaires sur cette publication ou si vous avez des questions, visitez le FAQ du Service clients ou contactez-nous: Email: csciec.ch Tl.: +41 22 919 02 11 Fax: +41 22 919 03 00 IEC 61508-6 Edition 2.0 2010-04 INTERNATIONAL STANDARD NORME INTERNATIONAL
17、E Functional safety of electrical/electronic/programmable electronic safety-related systems Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3 Scurit fonctionnelle des systmes lectriques/lectroniques/lectroniques programmables relatifs la scurit Partie 6: Lignes directrices pour la
18、pplication de la CEI 61508-2 et de la CEI 61508-3 INTERNATIONAL ELECTROTECHNICAL COMMISSION COMMISSION ELECTROTECHNIQUE INTERNATIONALE XE ICS 25.040.40 PRICE CODE CODE PRIX ISBN 978-2-88910-529-8 Registered trademark of the International Electrotechnical Commission Marque dpose de la Commission Elec
19、trotechnique Internationale 2 61508-6 IEC:2010 CONTENTS FOREWORD.6 INTRODUCTION.8 1 Scope.10 2 Normative references .12 3 Definitions and abbreviations12 Annex A (informative) Application of IEC 61508-2 and of IEC 61508-3.13 Annex B (informative) Example of technique for evaluating probabilities of
20、hardware failure .21 Annex C (informative) Calculation of diagnostic coverage and safe failure fraction worked example76 Annex D (informative) A methodology for quantifying the effect of hardware-related common cause failures in E/E/PE systems80 Annex E (informative) Example applications of software
21、 safety integrity tables of IEC 61508-3 .95 Bibliography110 Figure 1 Overall framework of the IEC 61508 series 11 Figure A.1 Application of IEC 61508-2 .17 Figure A.2 Application of IEC 61508-2 (Figure A.1 continued)18 Figure A.3 Application of IEC 61508-3 .20 Figure B.1 Reliability Block Diagram of
22、 a whole safety loop .22 Figure B.2 Example configuration for two sensor channels.26 Figure B.3 Subsystem structure .29 Figure B.4 1oo1 physical block diagram.30 Figure B.5 1oo1 reliability block diagram31 Figure B.6 1oo2 physical block diagram.32 Figure B.7 1oo2 reliability block diagram32 Figure B
23、.8 2oo2 physical block diagram.33 Figure B.9 2oo2 reliability block diagram33 Figure B.10 1oo2D physical block diagram.33 Figure B.11 1oo2D reliability block diagram .34 Figure B.12 2oo3 physical block diagram.34 Figure B.13 2oo3 reliability block diagram35 Figure B.14 Architecture of an example for
24、 low demand mode of operation40 Figure B.15 Architecture of an example for high demand or continuous mode of operation 49 Figure B.16 Reliability block diagram of a simple whole loop with sensors organised into 2oo3 logic 51 Figure B.17 Simple fault tree equivalent to the reliability block diagram p
25、resented on Figure B.1.52 Figure B.18 Equivalence fault tree / reliability block diagram52 Figure B.19 Instantaneous unavailability U(t) of single periodically tested components 54 Figure B.20 Principle of PFD avgcalculations when using fault trees.55 61508-6 IEC:2010 3 Figure B.21 Effect of stagger
26、ing the tests 56 Figure B.22 Example of complex testing pattern 56 Figure B.23 Markov graph modelling the behaviour of a two component system 58 Figure B.24 Principle of the multiphase Markovian modelling.59 Figure B.25 Saw-tooth curve obtained by multiphase Markovian approach.60 Figure B.26 Approxi
27、mated Markovian model 60 Figure B.27 Impact of failures due to the demand itself61 Figure B.28 Modelling of the impact of test duration.61 Figure B.29 Multiphase Markovian model with both DD and DU failures.62 Figure B.30 Changing logic (2oo3 to 1oo2) instead of repairing first failure63 Figure B.31
28、 “Reliability“ Markov graphs with an absorbing state 63 Figure B.32 “Availability“ Markov graphs without absorbing states .65 Figure B.33 Petri net for modelling a single periodically tested component.66 Figure B.34 Petri net to model common cause failure and repair resources69 Figure B.35 Using rel
29、iability block diagrams to build Petri net and auxiliary Petri net for PFD and PFH calculations .70 Figure B.36 Simple Petri net for a single component with revealed failures and repairs 71 Figure B.37 Example of functional and dysfunctional modelling with a formal language.72 Figure B.38 Uncertaint
30、y propagation principle73 Figure D.1 Relationship of common cause failures to the failures of individual channels.82 Figure D.2 Implementing shock model with fault trees93 Table B.1 Terms and their ranges used in this annex (applies to 1oo1, 1oo2, 2oo2, 1oo2D, 1oo3 and 2oo3) 27 Table B.2 Average pro
31、bability of failure on demand for a proof test interval of six months and a mean time to restoration of 8 h .36 Table B.3 Average probability of failure on demand for a proof test interval of one year and mean time to restoration of 8 h.37 Table B.4 Average probability of failure on demand for a pro
32、of test interval of two years and a mean time to restoration of 8 h 38 Table B.5 Average probability of failure on demand for a proof test interval of ten years and a mean time to restoration of 8 h 39 Table B.6 Average probability of failure on demand for the sensor subsystem in the example for low
33、 demand mode of operation (one year proof test interval and 8 h MTTR) 40 Table B.7 Average probability of failure on demand for the logic subsystem in the example for low demand mode of operation (one year proof test interval and 8 h MTTR) 41 Table B.8 Average probability of failure on demand for th
34、e final element subsystem in the example for low demand mode of operation (one year proof test interval and 8 h MTTR) 41 Table B.9 Example for a non-perfect proof test 42 Table B.10 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of
35、 one month and a mean time to restoration of 8 h 45 4 61508-6 IEC:2010 Table B.11 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of three month and a mean time to restoration of 8 h 46 Table B.12 Average frequency of a dangerous fa
36、ilure (in high demand or continuous mode of operation) for a proof test interval of six month and a mean time to restoration of 8 hError! Bookmark not defined. Table B.13 Average frequency of a dangerous failure (in high demand or continuous mode of operation) for a proof test interval of one year a
37、nd a mean time to restoration of 8 hError! Bookmark not defined. Table B.14 Average frequency of a dangerous failure for the sensor subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8 h MTTR) .49 Table B.15 Average frequency of a dangerous fa
38、ilure for the logic subsystem in the example for high demand or continuous mode of operation (six month proof test interval and 8 h MTTR) .50 Table B.16 Average frequency of a dangerous failure for the final element subsystem in the example for high demand or continuous mode of operation (six month
39、proof test interval and 8 h MTTR) .50 Table C.1 Example calculations for diagnostic coverage and safe failure fraction 78 Table C.2 Diagnostic coverage and effectiveness for different elements 79 Table D.1 Scoring programmable electronics or sensors/final elements .88 Table D.2 Value of Z programmab
40、le electronics89 Table D.3 Value of Z sensors or final elements .89 Table D.4 Calculation of intor D int 90 Table D.5 Calculation of for systems with levels of redundancy greater than 1oo2 91 Table D.6 Example values for programmable electronics .92 Table E.1 Software safety requirements specificati
41、on 96 Table E.2 Software design and development software architecture design.97 Table E.3 Software design and development support tools and programming language.98 Table E.4 Software design and development detailed design .99 Table E.5 Software design and development software module testing and inte
42、gration 100 Table E.6 Programmable electronics integration (hardware and software)100 Table E.7 Software aspects of system safety validation .101 Table E.8 Modification .101 Table E.9 Software verification 102 Table E.10 Functional safety assessment 102 Table E.11 Software safety requirements specif
43、ication 104 Table E.12 Software design and development software architecture design .104 Table E.13 Software design and development support tools and programming language.105 Table E.14 Software design and development detailed design .106 Table E.15 Software design and development software module te
44、sting and integration 106 Table E.16 Programmable electronics integration (hardware and software)107 Table E.17 Software aspects of system safety validation .108 Table E.18 Modification .108 61508-6 IEC:2010 5 Table E.19 Software verification 109 Table E.20 Functional safety assessment 109 6 61508-6
45、 IEC:2010 INTERNATIONAL ELECTROTECHNICAL COMMISSION _ FUNCTIONAL SAFETY OF ELECTRICAL/ELECTRONIC/ PROGRAMMABLE ELECTRONIC SAFETY-RELATED SYSTEMS Part 6: Guidelines on the application of IEC 61508-2 and IEC 61508-3 FOREWORD 1) The International Electrotechnical Commission (IEC) is a worldwide organiz
46、ation for standardization comprising all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and in addition to other activities, IE
47、C publishes International Standards, Technical Specifications, Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt wit
48、h may participate in this preparatory work. International, governmental and non- governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations. 2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical com
