Generische Normen zur Funktionalen Sicherheit im Maschinenbau. IEC und ISO 13849

Transkript

1 Generische Normen zur Funktionalen Sicherheit im Maschinenbau IEC und ISO Thomas Bömer, VDE/DKE-TAGUNG 20 JAHRE IEC

2 Politik nach dem Merging IEC/TC44 und ISO/TC199 treffen Beschlüsse zur Überarbeitung von IEC und ISO Gemeinsame JAG von IEC und ISO gibt folgende Empfehlungen: Die Arbeitsgruppen sollen versuchen gleiche Elemente, vergleichbar zu behandeln (geplant z.b. für Validierung und Software) Ziel der Revision der Normen ist es Lücken durch gute Koordination zwischen den beiden Arbeitsgruppen Schritt für Schritt zu begrenzen. Die Anwender der Normen benötigen Stabilität (ohne zusätzliche Anforderungen). Nach der Überarbeitung sollen nochmals die Möglichkeiten für eine Zusammenlegung überprüft werden. Thomas Bömer 2

3 Aktueller Stand der Arbeiten IEC Erster CD im Februar 2017 This standard is machine sector specific within the framework of IEC and reflects the outcome of the joint working group between ISO/ TC 199 and IEC/ TC 44 as basis for a future merging of both standards ISO and IEC Einbeziehung von Nichtelektrik und Low Demand Mode ISO Erster CD für Ende 2017 geplant, aktuell interner WD Verbesserung der Struktur Vorschläge für viele Detailänderungen z.b. zu bewährten Bauteilen, Verfahren bei fehlenden Bauteildaten, technische Maßnahmen gegen CCF, Software, Thomas Bömer 3

4 Risikominderung im Kontext von ISO IEC ISO Step 2 of three-step method of ISO Step 1 Can the risk be reduced by inherently safe design measures? YES Risk reduction by inherently safe design measures Is the intended risk reduction achieved? NO NO Step 2 Risk reduction by safeguarding Can the risk be reduced by guards, Protective devices? YES Implementation of complementary protective measures If the selected risk reduction measure depends on the control system then the SCS can be designed by application of IEC (see Figure 2) Is the intended risk reduction achieved? NO NO Thomas Bömer 4

5 Begriff Subsystem nun auch in ISO D SET Q 0 & 0 L CLR Q 0 Input subsystem (e.g. light curtain) Logic subsystem (e.g. safety relais) Output subsystem (e.g. valves) Thomas Bömer 5

6 Grundlegende und bewährte Sicherheitsprinzipien, Bewährte Bauteile nun auch in IEC Thomas Bömer 6

7 Weitere Gemeinsamkeiten Beispiele für MTTF D einzelner hydraulischer, pneumatischer und elektromechanischer Bauteile inklusive B 10D (Anhang) Fehlerausschlüsse und Fehlerannahmen nach ISO Beispiele für den Diagnosedeckungsgrad (Anhang), Erläuterungen in ISO teilweise in Erarbeitung Software basierende manuelle Parameterisierung Anhang zum Verhältnis der beiden Normen Thomas Bömer 7

8 Neu: Software Level SW Level A SW Level B SW Level C Use of a pre-assessed software-platform designed for safety applications: Typically a combination of pre-assessed software modules. Use of a software-platform for designing application software typically running on a programmable controller according to IEC /-2, both not designed explicitly for safety application. Use of a language other than a limited variability language (LVL). Typically in an embedded software application. nach IEC 62061:2017/CD Thomas Bömer 8

9 Vereinfachtes V-Modell für SW Level A Auch individuell angepasste Softwaremodule im SW Level A möglich Thomas Bömer 9

10 V-Modell für SW Level B und C Software safety requirements Software design Test Software testing Tested Software Software design specification Review Software system design Test Software integration testing Tested integration Software system design specification Review Module design Test Module test Tested modules Module design specification Review Coding Reviewed code Thomas Bömer 10

11 Software-Sicherheitsanforderungen Zusätzliche Anforderungen für SW Level B (HFT = 1) Redundant diverse hardware architecture (e.g. Category 3 / HFT = 1) Failures Measures Comparison Memory test External monitoring Program sequence monitoring Time- Out Synchronisation Alteration by HW Failure X X X Alteration by SW Failure X Soft error X X Non execution X X X X X partial execution X X X Wrong execution X X X Insertion of SW parts X X X Execution delayed X X X Replay X X X DC 60% - 90% 60% 60% 60% - 90% 60% 90% X Thomas Bömer 11

12 Routes Software Level A B C Software-Route B1 B2 B3 B4 B5 C1 C2 C3 maximum SIL achievable maximum PL achievable e d d c c b e d e software designed and tested according to software platform hardware platform IEC x x this standard x x x x x x x diversity required x x pre-assessed x * * * not designed explicitly for safety application x x x x x diversity required x x x pre-assessed x ** ** ** not designed explicitly for safety application x x x x x diversity required x x x HFT category according to ISO B 3/4 * If a software platform is used, e.g. an operating system, it has to satisfy the requirements of a functional safety standard. ** The hardware platform has to satisfy the requirements of a functional safety standard. Thomas Bömer 12

13 Routes Software Level A B C Software-Route B1 B2 B3 B4 B5 C1 C2 C3 maximum SIL achievable maximum PL achievable e d d c c b e d e software designed and tested according to software platform hardware platform IEC x x this standard x x x x x x x diversity required x x pre-assessed x * * * not designed explicitly for safety application x x x x x diversity required x x x pre-assessed x ** ** ** not designed explicitly for safety application x x x x x diversity required x x x HFT category according to ISO B 3/4 * If a software platform is used, e.g. an operating system, it has to satisfy the requirements of a functional safety standard. ** The hardware platform has to satisfy the requirements of a functional safety standard. Thomas Bömer 13

14 Routes Software Level A B C Software-Route B1 B2 B3 B4 B5 C1 C2 C3 maximum SIL achievable maximum PL achievable e d d c c b e d e software designed and tested according to software platform hardware platform IEC x x this standard x x x x x x x diversity required x x pre-assessed x * * * not designed explicitly for safety application x x x x x diversity required x x x pre-assessed x ** ** ** not designed explicitly for safety application x x x x x diversity required x x x HFT category according to ISO B 3/4 * If a software platform is used, e.g. an operating system, it has to satisfy the requirements of a functional safety standard. ** The hardware platform has to satisfy the requirements of a functional safety standard. Thomas Bömer 14

15 FVL in IEC 62061? Functional safety plan: describe the strategy to achieve functional safety for the application software, development, integration, verification and validation; Subsystem architecture design Subsystem(s) incorporating complex components shall comply with appropriate product standards or IEC and IEC as appropriate for the required SIL Thomas Bömer 15

16 Validierung Requirements of the safety function, in particular: a) functional requirements b) SIL or PL 1) architecture / category 2) systematic integrity 3) software c) environmental conditions Validation principles Start of validation Safety plan _contains_ Das Kernthema der ISO Validierung wird im Teil 1 integriert _in context of_ Design documents Validation plan Analysis Criteria for exclusion Fault Lists > 90 % Textgleichheit zw. ISO und IEC im aktuellen Bearbeitungsstand Analysis passed yes Testing no Testing passed _no_ yes diagnostic function used? yes Test of safety function under fault condition no Testing passed _no_ Modification of design yes Verification report All safety functions validated? _no_ yes Validation successful (validation report) Thomas Bömer 16

17 Einige wichtige Unterschiede Thomas Bömer 17