Can An E/E/PE Safety-Related System Contain Hardware And/Or Software That Was Not Produced According To IEC 61508, And Still Comply With The Standard (Proven In Use)?

It may be possible to use a proven in use argument as an alternative to meeting the design requirements for dealing with systematic failure causes in IEC 61508, including hardware and software. But it is essential to note that proven in use cannot be used as an alternative to meeting the requirements for:

• architectural constraints on hardware safety integrity (see 7.4.2.1 of IEC 61508-2);
• the quantification of dangerous failures of the safety function due to random hardware faults (see 7.4.3.2 of IEC 61508-2); and
• system behaviour on detection of faults (see 7.4.6 of IEC 61508-2).

See 7.4.2.2 of IEC 61508-2 for a summary of design requirements, including references to more detailed systematic hardware requirements in the standard.

A proven in use claim relies on the availability of historical data for both random hardware and systematic failures, and on analytical techniques and testing if the previous conditions of use of the subsystem differ in any way from those which will be experienced in the E/E/PE safety-related system. 7.4.7.6 of IEC 61508-2 requires that:

• the previous conditions of use of the subsystem are the same as, or sufficiently close to, those which will be experienced in the E/E/PE safety-related system (see 7.4.7.7 of IEC 61508-2);
• if the above conditions of use differ in any way, a demonstration is necessary (using a combination of appropriate analytical techniques and testing) that the likelihood of unrevealed systematic faults is low enough to achieve the required safety integrity level of the safety functions which use the subsystem (see 7.4.7.8 of IEC 61508-2);
• the claimed failure rates have sufficient statistical basis (see 7.4.7.9 of IEC 61508-2);
• failure data collection is adequate (see 7.4.7.10 of IEC 61508-2);
• evidence is assessed taking into account the complexity of the subsystem, the contribution made by the subsystem to the risk reduction, the consequences associated with a failure of the subsystem, and the novelty of design (see 7.4.7.11 of IEC 61508-2); and
• the application of the proven in use subsystem is restricted to those functions and interfaces of the subsystem that meet the relevant requirements (see 7.4.7.12 of IEC 61508-2).

7.4.2.11 of IEC 61508-3 allows the use of standard or previously developed software without the availability of historical data but with the emphasis on analysis and testing. This concept should be distinguished from the proven in use concept described above.

 

This text contains extracts from the IEC Functional Safety Zone. All such extracts are copyright of International Electrotechnical Commission © 2005, IEC, Geneva, Switzerland. All rights reserved. IEC has no responsibility for the placement and context in which the extracts are reproduced. This notice takes precedence over any general copyright statement.