Potential of Fault-Detection Coverage by means of On-Chip Redundancy - IEC61508: Are There Royal Roads to SIL 4?

Abstract

SUMMARYThis paper investigates potential to improve faultdetection coverage by means of on-chip redundancy. The international standard on functional safety, namely, IEC61508 Ed. 2.0 Part 2 Annex E.3 prescribes the upper bound of β IC (common cause failure (CCF) ratio to all failures) is 0.25 to satisfy frequency upper bound of dangerous failure in the safety function for SIL (Safety Integrated Level) 3. On the other hand, this paper argues that the β IC does not necessarily have to be less than 0.25 for SIL 3, and that the upper bound of β IC can be determined depending on failure rate λ and CCF detection coverage. In other words, the frequency upper bound of dangerous failure for SIL3 can also be satisfied with β IC higher than 0.25 if the failure rate λ is lower than 400 [fit]. Moreover, the paper shows that on-chip redundancy has potential to satisfy SIL 4 requirement; the frequency upper bound of dangerous failure for SIL4 can be satisfied with feasible ranges of β IC , λ and CCF coverage which can be realized by redundant code.

Design and Analysis of Double One Out of Two with a Hot Standby Safety Redundant Structure

“…Firstly, the structure of (1oo2 + 1) * 2 is described. And then, according to IEC61508 [24,25] , considering the common cause failure, fault diagnosis rate, switching success rate and repair rate, the Markovian approach and equivalent parameter method is adopted for state division and transformation analysis of three safety redundant structures [26−28] , including two out of three, double one out of two, one out of two with a hot standby(1oo2 + 1) and double one out of two with a hot standby to calculate reliability and safety indicators. The calculation of the failure rate and P F H values is carried out with MATLAB to evaluate the reliability, safety and influencing factors of each structure [29,30] .…”