Source: http://www.iec.ch/functionalsafety/faq-ed2/page4.htm?iecfaq=6
Timestamp: 2015-07-04 22:42:53
Document Index: 578553652

Matched Legal Cases: ['art 1', 'art 2', 'art 3', 'art 4', 'arts 5', 'art 1', 'art 2', 'art 3', 'arts 5', 'arts 2', 'art 1']

In IEC 61508, the following contain normative elements: part 1 (excluding the annexe); part 2 (including annexes A, B, C, D, and E but excluding F); part 3 (including annexes A and D but excluding annexes B, C, E, F and G); and part 4. There are no normative requirements in parts 5, 6 and 7 of the standard.
In IEC 61508, the following are informative: annexe A of part 1; annex F of part 2; annexes B, C, E, F and G of part 3 and all annexes of parts 5, 6 and 7.
The safety integrity level (SIL 1, 2, 3 or 4) corresponds to a range of safety integrity values, measured for a specified safety function in terms of: the average probability of a dangerous failure on demand (for low demand mode of operation); or,
Note: For mode of operation see IEC 61508-4, subclause 3.5.16.
Annexes A and B of IEC 61508-3 contain the requirement that appropriate techniques and measures shall be selected according to the safety integrity level. In addition to the specific techniques listed in Annexes A and B, other techniques may be used providing that the requirements and objectives of the relevant clause of IEC 61508-3 have been met. Anyone claiming compliance with the standard is required to consider which techniques or measures are most appropriate for the specific problems encountered during the development of each E/E/PE safety-related system. See IEC 61508-3 Annex C (and supplementary information in IEC 61508-7 Annex F) for guidance on a reasoned argument to justify the selection of software techniques.
The IEC 61508-3 Annex A and B tables of recommended software techniques are not checklists by which systematic safety integrity in software can be guaranteed. Given the large number of factors that affect software systematic capability it is not possible to give an algorithm for combining the techniques and measures that will be correct for any given application. It is for this reason that Annex C (and supplementary information in IEC 61508-7 Annex F) has been developed and whose purpose is:
to give guidance on deciding between alternative techniques from Annexes A and B to achieve software systematic capability;
to outline a rationale for justifying the use of techniques that are not explicitly listed in Annexes A and B.
Software techniques will need to be chosen judiciously with attention to several key factors including:
national and international published standards.
Annexes A and B contain a recommendation that the rationale for not following the guidance for highly recommended or not recommended techniques or measures should be detailed during the safety planning and agreed with the assessor.
IEC 61508-1, clause 6 sets out the requirements on an organisation with responsibility for an E/E/PE safety-related system, or for one or more phases of the overall, E/E/PE system or software safety lifecycle. Also, IEC 61508-1, clause 5 sets out the documentation requirements. The fundamental requirement relating to the documentation is that it shall contain sufficient information, for each phase of the overall, E/E/PE system and software safety lifecycles completed, necessary for effective performance of subsequent phases and verification activities. (see clause 5 of IEC 61508-1).
Of particular importance in this context of this question is the "Safety manual for compliant items" (see IEC 61508-2, Annex D). The purpose of the safety manual for compliant items is to document all the information, relating to a compliant item, which is required to enable the integration of the compliant item into a safety-related system, or a subsystem or element, in compliance with the requirements of IEC 61508. In summary, IEC 61508 has requirements to ensure that the necessary information is available to achieve functional safety to those who have responsibility for its achievement. IEC 61508-1, clause 5 sets out the general requirements for the need to have sufficient information and the safety manual for compliant items specifies the information that has to be supplied in relation to an item (e.g. a component) on which the supplier is claiming compliance with specified clause(s) in IEC 61508.
Table 1 of IEC 61508-1 specifies the information necessary for each phase of the overall safety lifecycle. Table 1 of IEC 61508-2 and table 1 of IEC 61508-3 are the equivalents for the E/E/PE system safety and software safety lifecycles.
7.11.1 and parts 2 and 3:
To create E/E/PE safety-related systems conforming to the specification for the E/E/PE system safety requirements (comprising the specification for the E/E/PE system safety functions requirements and the specification for the E/E/PE system safety integrity requirements)
Specification for the E/E/PE safety requirements
Realisation of each E/E/PE safety-related system according to the E/E/PE system safety requirements specification
IEC 61508 covers all components of the E/E/PE safety-related system, including field equipment and specific project application logic. All these subsystems, elements and components, when combined to implement the safety function (or functions), are required to meet the safety integrity level target of the relevant safety functions. Any design using supplied subsystems and components that are all quoted as suitable for the required safety integrity level target of the relevant safety functions, together with the information associated with the supplied subsystems and components, will have to be assessed to determine whether or not the subsystems and components are in fact suitable. Suppliers of products intended for use in E/E/PE safety-related systems should provide sufficient information to facilitate a demonstration that the E/E/PE safety-related system complies with IEC 61508 and shall comply with Annex D of IEC 61508-2 (Safety manual for compliant items).
As a supplier of items (e.g. components/elements) for which you are claiming compliance with specified clauses of IEC 61508, you will need to comply with IEC 61508-2 Annex D "Safety manual for compliant items". The purpose of the safety manual for compliant items is to document all the information, relating to a compliant item, which is required to enable the integration of the compliant item into a safety-related system, or a subsystem or element, in compliance with the requirements of IEC 61508.
The following subclauses are particularly relevant in this context:
IEC 61508-2/7.4.9.6: Suppliers shall provide a safety manual for compliant items, in accordance with Annex D, for each compliant item that they supply and for which they claim compliance with IEC 61508 series.
IEC 61508-2/7.4.9.7: The supplier shall document a justification for all the information that is provided in each safety manual for compliant items.
Note 1: It is essential that the claimed safety performance of an element is supported by sufficient evidence. Unsupported claims do not help establish the correctness and integrity of the safety function to which the element contributes.
Note 2: There may be commercial or legal restrictions on the availability of the evidence. These restrictions are outside the scope of this standard. If such restrictions deny the functional safety assessment adequate access to the evidence, then the element is not suitable for use in E/E/PE safety-related systems. D8) Do I have to use third party certified components in order to comply with IEC 61508?
The level of independence required should be distinguished from the concept of third-party certification which is not a requirement in IEC 61508. For some companies even the requirement for independent persons and departments may have to be met by using an external organization but this does not mean that the external organisation has necessarily to be a certification body. The external body, in such a situation, should have the competence and the appropriate level of independence to undertake the task. The external body may or may not be a certification body.
Conversely, companies that have internal organizations skilled in risk assessment and the application of safety-related systems, which are independent of and separate (by ways of management and other resources) from those responsible for the main development, may be able to use their own resources to meet the requirements for an independent organization (note 2 of 8.2.12 of IEC 61508-1).
D13) How do electromagnetic immunity limits depend on the safety integrity level?
7.10.2.7 (f) of IEC 61508-1 states: The E/E/PE system safety integrity requirements specification shall contain: the electromagnetic immunity limits that are required to achieve functional safety. These limits should be derived taking into account both the electromagnetic environment and the required safety integrity levels (see IEC/TS 61000-1-2).
Note 5: Due to the nature and physics of electromagnetic phenomena no simple, evident and provable correlation can be established between the required immunity level and safety integrity level for nearly all cases of electromagnetic phenomena. Specifying effective immunity levels solely according to the required SIL is therefore not possible and reasonable in those cases. Alternative approaches may be used which, to some degree, specify the required immunity level according to the required SIL but also involve special test arrangements or test performance criteria. See IEC/TS 61000-1-2, Electromagnetic compatibility (EMC) - Part 1-2: General - Methodology for the achievement of functional safety of electrical and electronic systems including equipment with regard to electromagnetic phenomena.