EN 61508-7-2010 en Functional safety of electrical electronic programmable electronic safety-related systems - Part 7 Overview of techniques and measures《电气 电子 可编程电子安全相关系统的功能安全 第7部.pdf

1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationFunctional safety of electrical/electronic/programmable electronic safety related systemsPart 7: Overview of techniques and measuresBS EN 61508-7:2010National forewordThis Britis

2、h Standard is the UK implementation of EN 61508-7:2010. It isidentical to IEC 61508-7:2010. It supersedes BS EN 61508-7:2002 which iswithdrawn.The UK participation in its preparation was entrusted by Technical CommitteeGEL/65, Measurement and control, to Subcommittee GEL/65/1, System considerations.

3、A list of organizations represented on this committee can be obtained onrequest to its secretary.This publication does not purport to include all the necessary provisions of acontract. Users are responsible for its correct application. BSI 2010ISBN 978 0 580 65450 3ICS 13.260; 25.040.40; 29.020Compl

4、iance with a British Standard cannot confer immunity fromlegal obligations.This British Standard was published under the authority of the StandardsPolicy and Strategy Committee on 30 June 2010.Amendments issued since publicationAmd. No. Date Text affectedBRITISH STANDARDBS EN 61508-7:2010EUROPEAN ST

5、ANDARD EN 61508-7 NORME EUROPENNE EUROPISCHE NORM May 2010 CENELEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Management Centre: Avenue Marnix 17, B - 1000 Brussels 2010 CENELEC - All rights

6、 of exploitation in any form and by any means reserved worldwide for CENELEC members. Ref. No. EN 61508-7:2010 E ICS 25.040.40; 35.240.50 Supersedes EN 61508-7:2001English version Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 7: Overview of techniqu

7、es and measures (IEC 61508-7:2010) Scurit fonctionnelle des systmes lectriques/lectroniques/lectroniques programmables relatifs la scurit - Partie 7: Prsentation de techniques et mesures (CEI 61508-7:2010) Funktionale Sicherheit sicherheitsbezogener elektrischer/elektronischer/programmierbarer elekt

8、ronischer Systeme - Teil 7: berblick ber Verfahren und Manahmen (IEC 61508-7:2010) This European Standard was approved by CENELEC on 2010-05-01. CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status o

9、f a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the Central Secretariat or to any CENELEC member. This European Standard exists in three official versions (English, French, German). A v

10、ersion in any other language made by translation under the responsibility of a CENELEC member into its own language and notified to the Central Secretariat has the same status as the official versions. CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croati

11、a, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. BS EN 61508-7:2010EN 6

12、1508-7:2010 - 2 - Foreword The text of document 65A/554/FDIS, future edition 2 of IEC 61508-7, prepared by SC 65A, System aspects, of IEC TC 65, Industrial-process measurement, control and automation, was submitted to the IEC-CENELEC parallel vote and was approved by CENELEC as EN 61508-7 on 2010-05

13、-01. This European Standard supersedes EN 61508-7:2001. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN and CENELEC shall not be held responsible for identifying any or all such patent rights. The following dates were fixed: l

14、atest date by which the EN has to be implemented at national level by publication of an identical national standard or by endorsement (dop) 2011-02-01 latest date by which the national standards conflicting with the EN have to be withdrawn (dow) 2013-05-01 Annex ZA has been added by CENELEC. _ Endor

15、sement notice The text of the International Standard IEC 61508-7:2010 was approved by CENELEC as a European Standard without any modification. In the official version, for Bibliography, the following notes have to be added for the standards indicated: 1 IEC 60068-1:1988 NOTE Harmonized as EN 60068-1

16、:1994 (not modified). 2 IEC 60529:1989 NOTE Harmonized as EN 60529:1991 (not modified). 3 IEC 60812:2006 NOTE Harmonized as EN 60812:2006 (not modified). 4 IEC 60880:2006 NOTE Harmonized as EN 60880:2009 (not modified). 5 IEC 61000-4-1:2006 NOTE Harmonized as EN 61000-4-1:2007 (not modified). 6 IEC

17、61000-4-5:2005 NOTE Harmonized as EN 61000-4-5:2006 (not modified). 8 IEC 61025:2006 NOTE Harmonized as EN 61025:2007 (not modified). 9 IEC 61069-5:1994 NOTE Harmonized as EN 61069-5:1995 (not modified). 10 IEC 61078:2006 NOTE Harmonized as EN 61078:2006 (not modified). 11 IEC 61131-3:2003 NOTE Harm

18、onized as EN 61131-3:2003 (not modified). 12 IEC 61160:2005 NOTE Harmonized as EN 61160:2005 (not modified). 13 IEC 61163-1:2006 NOTE Harmonized as EN 61163-1:2006 (not modified). 14 IEC 61164:2004 NOTE Harmonized as EN 61164:2004 (not modified). 15 IEC 61165:2006 NOTE Harmonized as EN 61165:2006 (n

19、ot modified). 16 IEC 61326-3-1:2008 NOTE Harmonized as EN 61326-3-1:2008 (not modified). 17 IEC 61326-3-2:2008 NOTE Harmonized as EN 61326-3-2:2008 (not modified). 18 IEC 81346-1:2009 NOTE Harmonized as EN 81346-1:2009 (not modified). BS EN 61508-7:2010- 3 - EN 61508-7:2010 21 IEC 61511 series NOTE

20、Harmonized in EN 61511 series (not modified). 22 IEC 62061:2005 NOTE Harmonized as EN 62061:2005 (not modified). 23 IEC 62308:2006 NOTE Harmonized as EN 62308:2006 (not modified). 37 IEC 61800-5-2 NOTE Harmonized as EN 61800-5-2. 38 IEC 60601 series NOTE Harmonized in EN 60601 series (partially modi

21、fied). 39 IEC 60068-2-1 NOTE Harmonized as EN 60068-2-1. 40 IEC 60068-2-2 NOTE Harmonized as EN 60068-2-2. 41 ISO 9000 NOTE Harmonized as EN ISO 9000. 42 IEC 61508-1:2010 NOTE Harmonized as EN 61508-1:2010 (not modified). 43 IEC 61508-2:2010 NOTE Harmonized as EN 61508-2:2010 (not modified). 44 IEC

22、61508-3:2010 NOTE Harmonized as EN 61508-3:2010 (not modified). 45 IEC 61508-6:2010 NOTE Harmonized as EN 61508-6:2010 (not modified). _ BS EN 61508-7:2010EN 61508-7:2010 - 4 - Annex ZA (normative) Normative references to international publications with their corresponding European publications The

23、following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. NOTE When an international publication has been modif

24、ied by common modifications, indicated by (mod), the relevant EN/HD applies. Publication Year Title EN/HD Year IEC 61508-4 2010 Functional safety of electrical/electronic/programmable electronic safety-related systems - Part 4: Definitions and abbreviations EN 61508-4 2010 BS EN 61508-7:2010 2 61508

25、-7 IEC:2010 CONTENTS INTRODUCTION.5 1 Scope.7 2 Normative references .9 3 Definitions and abbreviations9 Annex A (informative) Overview of techniques and measures for E/E/PE safety-related systems: control of random hardware failures (see IEC 61508-2)10 Annex B (informative) Overview of techniques a

26、nd measures for E/E/PE safety related systems: avoidance of systematic failures (see IEC 61508-2 and IEC 61508-3) 27 Annex C (informative) Overview of techniques and measures for achieving software safety integrity (see IEC 61508-3).54 Annex D (informative) A probabilistic approach to determining so

27、ftware safety integrity for pre-developed software .107 Annex E (informative) Overview of techniques and measures for design of ASICs .112 Annex F (informative) Definitions of properties of software lifecycle phases.126 Annex G (informative) Guidance for the development of safety-related object orie

28、nted software132 Bibliography134 Index 137 Figure 1 Overall framework of IEC 61508.8 Table C.1 Recommendations for specific programming languages .86 Table D.1 Necessary history for confidence to safety integrity levels .107 Table D.2 Probabilities of failure for low demand mode of operation 108 Tab

29、le D.3 Mean distances of two test points 109 Table D.4 Probabilities of failure for high demand or continuous mode of operation .110 Table D.5 Probability of testing all program properties .111 Table F.1 Software Safety Requirements Specification 126 Table F.2 Software design and development: softwa

30、re architecture design 127 Table F.3 Software design and development: support tools and programming language.128 Table F.4 Software design and development: detailed design 128 Table F.5 Software design and development: software module testing and integration.129 Table F.6 Programmable electronics in

31、tegration (hardware and software)129 Table F.7 Software aspects of system safety validation .130 Table F.8 Software modification.130 Table F.9 Software verification.131 Table F.10 Functional safety assessment 131 Table G.1 Object Oriented Software Architecture.132 Table G.2 Object Oriented Detailed

32、Design133 Table G.3 Some Oriented Detailed terms.133 BS EN 61508-7:201061508-7 IEC:2010 5 INTRODUCTION Systems comprised of electrical and/or electronic elements have been used for many years to perform safety functions in most application sectors. Computer-based systems (generically referred to as

33、programmable electronic systems) are being used in all application sectors to perform non-safety functions and, increasingly, to perform safety functions. If computer system technology is to be effectively and safely exploited, it is essential that those responsible for making decisions have suffici

34、ent guidance on the safety aspects on which to make these decisions. This International Standard sets out a generic approach for all safety lifecycle activities for systems comprised of electrical and/or electronic and/or programmable electronic (E/E/PE) elements that are used to perform safety func

35、tions. This unified approach has been adopted in order that a rational and consistent technical policy be developed for all electrically-based safety-related systems. A major objective is to facilitate the development of product and application sector international standards based on the IEC 61508 s

36、eries. NOTE 1 Examples of product and application sector international standards based on the IEC 61508 series are given in the bibliography (see references 21, 22 and 37). In most situations, safety is achieved by a number of systems which rely on many technologies (for example mechanical, hydrauli

37、c, pneumatic, electrical, electronic, programmable electronic). Any safety strategy must therefore consider not only all the elements within an individual system (for example sensors, controlling devices and actuators) but also all the safety-related systems making up the total combination of safety

38、-related systems. Therefore, while this International Standard is concerned with E/E/PE safety-related systems, it may also provide a framework within which safety-related systems based on other technologies may be considered. It is recognized that there is a great variety of applications using E/E/

39、PE safety-related systems in a variety of application sectors and covering a wide range of complexity, hazard and risk potentials. In any particular application, the required safety measures will be dependent on many factors specific to the application. This International Standard, by being generic,

40、 will enable such measures to be formulated in future product and application sector international standards and in revisions of those that already exist. This International Standard considers all relevant overall, E/E/PE system and software safety lifecycle phases (for example, from initial concept

41、, through design, implementation, operation and maintenance to decommissioning) when E/E/PE systems are used to perform safety functions; has been conceived with a rapidly developing technology in mind; the framework is sufficiently robust and comprehensive to cater for future developments; enables

42、product and application sector international standards, dealing with E/E/PE safety-related systems, to be developed; the development of product and application sector international standards, within the framework of this standard, should lead to a high level of consistency (for example, of underlyin

43、g principles, terminology etc.) both within application sectors and across application sectors; this will have both safety and economic benefits; provides a method for the development of the safety requirements specification necessary to achieve the required functional safety for E/E/PE safety-relat

44、ed systems; adopts a risk-based approach by which the safety integrity requirements can be determined; introduces safety integrity levels for specifying the target level of safety integrity for the safety functions to be implemented by the E/E/PE safety-related systems; NOTE 2 The standard does not

45、specify the safety integrity level requirements for any safety function, nor does it mandate how the safety integrity level is determined. Instead it provides a risk-based conceptual framework and example techniques. BS EN 61508-7:2010 6 61508-7 IEC:2010 sets target failure measures for safety funct

46、ions carried out by E/E/PE safety-related systems, which are linked to the safety integrity levels; sets a lower limit on the target failure measures for a safety function carried out by a single E/E/PE safety-related system. For E/E/PE safety-related systems operating in a low demand mode of operat

47、ion, the lower limit is set at an average probability of a dangerous failure on demand of 105; a high demand or a continuous mode of operation, the lower limit is set at an average frequency of a dangerous failure of 109h-1; NOTE 3 A single E/E/PE safety-related system does not necessarily mean a si

48、ngle-channel architecture. NOTE 4 It may be possible to achieve designs of safety-related systems with lower values for the target safety integrity for non-complex systems, but these limits are considered to represent what can be achieved for relatively complex systems (for example programmable elec

49、tronic safety-related systems) at the present time. sets requirements for the avoidance and control of systematic faults, which are based on experience and judgement from practical experience gained in industry. Even though the probability of occurrence of systematic failures cannot in general be quantified the standard does, however, allow a claim to be mad