Indeed, the analysis of dependability of a PEE system can allocate a level of confidence in the safety, reliability, availability and maintainability of the functions for which it was designed. These PEE systems are developed for the most part, to protect human environments in which it operates

Examples:

• An ESP is a safety system that allows a vehicle to follow the path defined by its driver.
• An ABS is a safety system that allows the driver of a vehicle to slow down without locking the wheels.
• A Platform Screen Door is a safety system that will prevent passengers from falling on the tracks.
• An overspeed control is a safety system that allows a process to trigger an emergency brake in excess of its authorized speed.
• A system of computerized aircraft flight is a safety system that allows the driver to limit the evolution in his plane.

But in all these examples, the high level of dependability of each item of equipment, not enough to ward off human accidents, it is not incorporated in a more comprehensive risk management.

Indeed, a driver designates an ESP system will rely on its safety system and move his attention elsewhere in the turns. Similarly for a driver equipped with an ABS system, it will shift its attention away from the safe distance. A passenger waiting for his subway will enjoy the safety system that covers up the track to enjoy the maximum space of the platform. Train drivers will rely on the safety of the speed controller to move its attention to other maneuvers. The pilot of aircraft will be based on the security system of the flight control computer to hire new workers.

Thus, a safety system can not alone replace the vigilance of its users. This decrease in alertness, reflected through changes in behavior must be incorporated into the overall risk analysis that integrates all other between the awareness and prevention, to take into account all the risks that will be induced by Installation a system in its environment.

The most current reliability definition is, the (probability of) capability of an entity to perform a required function, in a defined environment and during a defined period of time.

The goal objective

The goal objective in the design of a system, is that it will be able to perform the functions for which it has been designed, without thinking about the duration of its use.

However, the electrical/electronic systems are designed to based on components which have a limited life. It is therefore important to predict (statistically) the behavior of each of these components to obtain:

• A better antecipation of maintenance phases,
• A better control of the safety of this system,

And so, to optimize the best costs in the life cycle of the system.

It’s possible to speak about reliability prediction, the reliability of a system established before the use phase of the system, and of operational reliability, the reliability actually obtained during its operation.

The aim is, of course, to have a reliability prediction as close as possible of the operational reliability.

Methods to define the reliability of a electrical/electronic system

Define the system reliability means calculate the period of operation of each component until the moment of which the system will no longer fulfill its function. This duration is called MTTF (Mean Time To Failure).

To Define this period, it’ would be necessary to use suficient informations about the components of the system based on the Return Of Experience (ROE). This Return Of Experience may be created based on:

• A sufficient period of exploration of the behavior of components,
• Environmental conditions (Climate, vibration, temperature, EMC),
• The sufficient solicitation of these components.

In order to make this return of experience exploitable by the designers of electrical/electronic systems, the compilations were created in the 1960-70, in order to collect all the return of experience in the form of behavioral models for each of the components.

The first collection of reliability that have been created was the « American Military Handbook 217 » (MIL-HDBK-217). This first compilation has been established in 1962 by the American army, and the latest version of this collection dates from 1991. The first french compendium of reliability that have been created was the « Compendium of Reliability » (RDF 70). The compendium has been prepared from a return of experience of France Télécom, and now, this collection is a standard called UTE C 80-810.  From these two collections the RAMS guide was born, which incorporates the models of the collection HDBK-217 and RDF 2000, and is enriched by the return of experience of a consortium of French manufacturers.

Thus, all of these behavioral models, based on the return of experience, has been created to facilitate the statistical calculation of reliability of a designed system with a basis on electrical components, but must evolve continuously to be able to integrate always more return of experience and components.

Thus the designation SIL, determined to a system, refers automatically on a function(s) of the E/E/EP system(Electrical/Electronics/Electronics Programmable), for then to be extended, by conseption, to the hardware(s) and/or software(s) component(s) who participate in that function(s).

More specifically, if one considers a simplified digital telephone system , the most important functions are:

• to call,
• to receive a call

Thus the level of confidence associated with this system resides in fact, on the successful implementation of its functions. Then, these functions are, by conseption, spread over different components of the system which can be software (signal processing software, the software management of the display,..), or hardware (the keyboard, the LCD screen, the electronic board, power supply,…).

Thus the safet integrity level SIL automatically refers on, a function of a system, which itself refers automatically on hardware or software, and this, of course in the case of systems E/E/EP. One will speak therefore of safety integrity of a function, safety integrityintegrity of security of an equipment and safety integrity of a software, with:

• The Safety integrity of hardware is to define the part of the safety integrity linked to random failures of the equipment which could lead to an dangerous event.
• The safety integrity of software is to define the probability, for a software, in a programmable electronic system , to execute correctly its safety related functions in all the specified conditions.

Allow to define mathematically and rigorously the properties of operation of a system. Formal methods may apply to any stage of development of a project, as well from the specification phase to the phase of implementation.

The operational safety :

aims to ensure, with a certain level of confidence, the impossibility of dangerous behavior of a system or equipment. In other words, this «insurance for the proper functioning »  requires clear and strict operation control of the system or equipment.

Thus, formal methods, highly recommended at the beginning of the development cycle of a system, like in the stages of specification of the safety properties of a system with high integrity level (SIL4 for EN 61508 and SIL3 SIL4 to EN 50128), make the process of operational safety with safety requirements specified in a structured way clear, precise, unambiguous, verifiable, testable, maintainable, and free of ambiguous terms or description and / or likely to be misunderstood by the users of the document to all stages of development.

CEI 61508 ans its derivatives

• The CEI 61511 standard, introduced in 2003, is the standard adapted from the IEC 61508 standard for industrial processes.
• The CEI 61513 standard, introduced in 2001, is the standard adapted from the IEC 61508 standard for the nuclear sector.
• The CEI 62061 standard, introduced in 2005, is the standard adapted from the IEC 61508 standard for the safety of machines.
• The EN 50126/EN 50128/EN 50129 standards, established respectively for the latest versions, in 1999/2001/2003, are standards adapted from the 61508 standard for the railway sector.
• The ISO 26262 standard is being developed and its release is foreseen for 2009,and it is the adaptation of the IEC 61508 standard for the automotive sector.

In this article, we will only talk about the standards represented by an orange square in the picture above.

The main lines of IEC 61508:

The IEC 61508 standard deals with the functional safety of electrical/electronic systems and programmable electronic (E/E/EP). This standard approach is very generic to enable the integration of all security systems E/E/PE.
This standard is decomposed in 7 parts :

• Part 1 : General Requirements,
• Part 2 : Requirements for systems E/E/PES safety related ,
• Part 3 : Software requirements,
• Part 4 : Definitions et abreviations,
• Part 5 : Example of Methods to determinate the SIL (Safet Inegrity Level) ,
• Part 6 : Guidelines for the application of the parts 2 and 3,
• Part 7 : Presentation of techniques and measures.

This standard has revolutionized the world of the operational safety because despite its aspect generic, it brings novelties in the way to integrate and achieve the activities of operational safety in the developement cycle of a system E/E/PE.

The standard has helped to define the levels of integrity for systems E/E/PE which take into account, in the risk management, as well the quantitative and qualitative aspects.
In addition, the standard integrates the safety activities, in parallel to the life cycle of the system E/E/EP, and these are adapted according to Safety Integrity Level (known as the name of “SIL:”) desired. (See our article on SIL standards).
By its generic aspect, the IEC 61508 standard breafly describes tools, methods and techniques of implementation.

EN 50126/EN 50128/EN 50129 Standards:

In the purpose of be able to implement the approaches described in the IEC 61508 standard, in the railway field , three standards have been established:

EN 50126 – « Specification and demonstration of the reliability, availability, maintainability and safety»:

This standard allows to implement a consistent approach to management of the reliability, availability, maintainability and safety called RAMS. This standard can be applied in the rail industry throughout the life cycle because it integrates the requirements RAMS specific to this field.

EN 50128 – « Signalling Systems, telecommunications and treatment »:

This standard deals, in particular, with methods that are necessary to be used to provide software that can satisfy the requirements of safety integrity level for the railway field. The integrity of a software is distributed on five levels SIL, ranging from SIL 0 to SIL 4. These levels SIL are defined by association, in the risk management, to the frequency and the result of a hazardous event.
To be able to define the SIL level for this software, the technical and messurement needs are defined in this standard.

EN 50129 – « Railway applications – Safety electronics systems for signaling»:

This standard addresses all the issues related to the approval process ofindividual systems, that can be software or hardware, and which may exist in the framework of a global system. This standard defines the evidence to provide for the acceptance of each individual system in the light of its SIL integrity level.

ISO 26262 Standard

The ISO 26262 standard, also called ISO/CD 26262, is currently being written, and it should be released during 2009. This new standard redefines the five SIL levels (Safety Integrity Level) of the IEC 61508 standard in four levels, called ASIL (Automotive Safety Integrity Level) ranging from ASIL A to ASIL D. The level of ASIL is determined by a risk analysis taking into account the evaluation of the severity, controllability and the exhibition on events.
This standard focuses largely on the software. It deals with the safety , the design of the product, the system analysis, the development software and hardware and production managment.
The french version of this standard should be released during 2011.

During this fair, the main points which have attracted our attention were the following:

• The impact of the ISO 26262 on the actual state of the art safety concepts in automotive industry
• The main lines form FIDES 2008 guide,
• The risk control of systems on the automation of the Paris Metro line 1,
• The use of formal methods in the framework of industrial projects.

The impact of the ISO 26262 on the actual state of the art safety concepts in automotive industry:

The establishment of this new standard ISO 26262, is a genuine revolution in the automotive sector. This standard resumed many points already present in the standards well known by ClearSy such as the IEC 61508, 50129, 50128, while incorporating also the constraints inherent to the automotive sector.

The main lines form FIDES 2008 guide:

The release of new FIDES 2008 guide, is an important development of the system reliability, since this standard shall deliver a better way to predict reliablity than the standard of reliability MIL HDBK 217F, too old now (1990), that sometimes generate a mismatch between the result of foresight studies and the real conditions of aging.
In addition, this new standard integrates more returns from experience than famous standard RDF2000 (UTE C 81-810), because it is carried out by a European consortium comprising the major actors in the industry of defense and the aeronautics.

The risk control of systems on the automation of the Paris Metro line 1:

The control of risks on the automation of the line 1 is part of the major concerns of ClearSy, because ClearSy is an actor in the process of automation of this line, responsable for developing the full command control system for plataform screen doors which allows to manage the mixing between trains automatic and trains with drivers. (see our DOF1 project).

The use of formal methods in the framework of industrial projects:

As a developer and publisher of the Atelier B tool (tool for development of the B formal method), ClearSy contributes strongly to the deployment of this method in the industrial environment. ClearSy has therefore very closely interest to the advances and developments of formal methods in industrial fields.

Our opinion on the Conference Lambda Mu:

The Lambda Mu is an exhibition which is designed to address all aspects of the control of risk and safety of operation. This area is a very vast area which affects all activities in all industrial sectors.
For a long time, the question of the control of risks or the safety of operation was often left aside by the industrial people because it was not considered applicable to constraints imposed by the operational projects.
But, more and more, this question of the control of risk and safety of operation is considered in the implementation of industrial projects. ClearSy, as an actor in the achievement of operational safety for electronic systems/computer saw a real change in the way of thinking the projects. The Lambda Mu fair thus allows to realize the magnitude of the phenomenon.
Furthermore, this place is the opportunity to submit university and research works in the field of the control of risk and safety of operation.

Our Stand at Lambda Mu 16

Useful links

• Program of Lambda Mu 16
• lMdR Web site
• Our report of Lambda Mu 15