[SystemSafety] SIL ratings to be scrapped?
Peter Bernard Ladkin
ladkin at rvs.uni-bielefeld.de
Thu Aug 22 11:35:54 CEST 2013
To back up Martin's caveat with other reasons:
I would not argue for scrapping "low-demand" on the sole basis it is inappropriately applied - I
think there need to be significantly more reasons than that.
Reactor SCRAM systems are only meant to be used occasionally. Similarly, passenger-emergency-braking
systems on trains.
System functions which are invoked occasionally tend to not work when invoked. Emergency slides on
commercial transport aircraft exits work as a rule-of-thumb about half the time, which is why the
emergency-evacuation certification test is performed with only half the available exits.
So for such systems and functions there need to be defined proof tests and a defined interval for
proof tests. And those intervals are dependent upon how often you think the demand for the function
is likely to arise.
You don't have such things as proof tests or associated intervals for continuously-operating
safety-relevant functions, such as fly-by-wire control systems or ETCS.
Now, I agree that such things as proof tests are not relevant for pure SW "elements" (to use the
61508 preferred terminology), but that SW mostly sits inside something which executes the function
and for which proof tests are relevant. How are you going to deal with these differences
appropriately if the standard scraps the distinction?
PBL
On 8/22/13 9:30 AM, Jensen, Martin Faurschou Jensen wrote:
> I agree with the arguments below when it comes to systems, but we have to keep in mind that 61508 is also used for the development of single elements. For a sensor, designed and developed for use in a SIS, the demand mode makes sense, as this only needs to detect and report a situation, and does not need to contribute in maintaining the safe state afterwards.
> -----Original Message-----
> ......On Behalf Of ECHARTE MELLADO JAVIER
> Sent: 22. august 2013 09:20
> To: Peter Bernard Ladkin; systemsafety at lists.techfak.uni-bielefeld.de
> Subject: Re: [SystemSafety] SIL ratings to be scrapped?
>
> I have discussed this mater several times. I think that low demand criteria should disappear because it is usually a fallacious argument.
PBL
Prof. Peter Bernard Ladkin, Faculty of Technology, University of Bielefeld, 33594 Bielefeld, Germany
Tel+msg +49 (0)521 880 7319 www.rvs.uni-bielefeld.de
More information about the systemsafety
mailing list