Based on my experience, I’ll tell you about the instrument safety certification process and the things to keep in mind

Thread Content

This post takes the case of a digital input safety barrier that has obtained TUV functional safety certification as an example to explain the process of functional safety certification based on the IEC 61508 standard. It provides a detailed overview of key aspects such as the sequence of steps in the certification process, the main tasks at each stage, and the latest changes in requirements from German certification auditors. It provides a reference for obtaining functional safety certification for products such as process testing and control devices. Around the year 2010, when many units under CNPC and Sinopec selected equipment, they explicitly required in their tender documents that certificates of functional safety must be provided. Without functional safety certification, instrument manufacturers missed many opportunities to participate. As people gradually realized the importance of such certification, they began to actively prepare for it. I believe some people feel the same way; when they first start with certification, they are very confused and don’t know where to begin. Based on practical experience with the functional safety certification of digital input safety barriers, this article introduces the certification requirements, certification process, and precautions. Safety certification process: yunrun.com.cn/news/1940.html. It would be presumptuous of me to elaborate on the role of functional safety certification in ensuring safety within modern industries; there are numerous professional articles online that discuss its importance. This paper takes the digital input safety barrier as an example to describe the process of functional safety certification based on the IEC 61508 standard. 1. As an explosion-proof product, an explosion-proof certified safety barrier must meet mandatory international explosion-proof certification requirements in order to enter the international market; such certification must be obtained prior to functional safety certification. Many certification bodies provide information on the IECEX explosion protection certification process. ①The applicant submits a written request for certification, along with relevant product documentation, to a certification body authorized by the IECEX system. After the organization accepts the application, the applicant signs a certification commission contract with the certification body. ②The certification body conducts explosion-proof type testing on the products applying for certification (including explosion-proof review of drawings and documents, as well as prototype testing) ； Review the explosion-proof inspection report. ③The certification body conducts inspections of the factory’s quality conditions at the manufacturing units applying for certification. ④The certification body evaluates the results of the type inspection and the factory inspection; if the evaluation is successful, an IECEX certification certificate is issued. ⑤The certification body conducts annual supervision of the applying entities. In fact, since the functional safety certification audit requires an assessment of the instrument’s safety integrity, it is possible that the circuitry will be modified, affecting the explosion-proof parameters ； Or, circuit adjustments may be required during the explosion-proof certification audit, and the safety integrity of the product must be re-evaluated; therefore, it is recommended to carry out both explosion-proof certification and functional safety certification simultaneously to avoid unnecessary waste of time, resources, and costs. Based on extensive experience in corporate certification processes, it is recommended to first submit the schematic drawings for explosion protection certification and undergo review during the conceptual stage of functional safety certification. Once the drawings related to explosion protection have been approved, efforts can be shifted to tasks such as FMEA analysis, FIT testing, and EMC/environmental testing for functional safety certification. Once the above is completed, the schematic diagram and circuit diagram can be essentially finalized, allowing work to proceed on finalizing the documents required for explosion-proof certification, conducting prototype testing, and carrying out factory audits. 2. Functional Safety Certification: The functional safety certification process can generally be divided into concept phase review, main inspection phase review, factory audit, and German re-review and certification ； More specifically, the main tasks can be further divided into design and development, documentation management and evaluation, hardware reliability calculation and assessment, EMC electromagnetic compatibility testing, environmental testing, etc. This article introduces the functional safety certification process using a digital input safety barrier as an example. The digital input safety barrier is a purely hardware-based circuit design, and therefore does not require evaluation of software safety and integrity; other instruments, however, may need such evaluations. Safety barrier: yunrun.com.cn/product/list_85.html ① Conceptual phase ◆ Safety Plan (SP) The Safety Plan specifies information such as project organization, project personnel and their qualifications, division of the safety lifecycle, plans for preventing failures, procedures for handling changes, and configuration management. http://yunrun.com.cn/upload/201804/25/201804252126471238.png Figure 1: Project Organization Chart ◆ Verification and Validation Plan (VVP) The Verification and Validation Plan specifies the verification activities at various stages of the safety life cycle, as well as the input and output documents and the persons responsible for verification. ◆ Safety Requirements Specification (SRS): The SRS defines safety functions, safety states, input/output descriptions and parameters, fault response time, SIL (Safety Integrity Level), the proportion of the safety barrier within the overall safety loop (TUV-recommended value: 10%), Safety Failure Fraction (SFF), hardware fault margin, inspection and testing intervals, operating modes, environmental requirements, etc. ◆ Safety Concept (SC): In the Safety Concept, the reliability block diagram and functional block diagram are defined (the functional safety portion is distinguished by a different color). It also specifies the functions of each functional block, the diagnostic measures employed for each block (which meet the corresponding SIL level), the interval between diagnostic tests for each block, and how each block transitions to a safe state after diagnosis. In fact, to ensure that the safety failure score meets the SIL level and to minimize subsequent document adjustments, the safety barriers certified by our company are first subjected to simple derating and FMEA analysis to identify and eliminate serious design defects as much as possible. ◆ Another very important document that runs throughout the entire certification process is the Requirement Traceability Table. In documents such as the Security Requirements Specification (SRS), Security Concepts (SC), Test Plan (TP), and Test Report (TR), each security-related item is numbered (SR1, SC1, TP1, TR1, etc.) to indicate the relationship between these items across different documents, thereby facilitating tracking across them. The audit comments from the certification body are sent to the applicant in the form of a LOP document. After several rounds of revisions, once all the comments from the certification body in the LOP have been addressed, it indicates that the safety barrier has passed the conceptual phase of evaluation by the certification body, and the certification process enters the main inspection phase. ② Main inspection phase: Tasks in this phase include further functional, safety, and environmental testing to verify whether the defined safety functions and SIL levels are achieved. ◆ Derating report: TÜV Rheinland requires that devices be derated. The more stringent of the two options—the 2/3 rule and Class 2 derating as specified in GJB/Z 35-93—must be implemented ； The derating of fuses, Zener diodes, and other intrinsically safe devices shall be carried out in accordance with the requirements of the national standard GB 3836. If a device’s derating does not meet the requirements, a suitable device must be selected anew. Table 1: Derating – Component Name, Specifications, Derating Parameters, Manual Requirements, Actual Value, Actual Derating, Conclusion
Inductor L1: 422776156; Transient Current (A): 0.8, 0.67; Derating Amount: 0.06, 0.09; Result: Pass. Dielectric Withstand Voltage (V): 800, 0.5; Derating Amount: 30, 0.0375; Result: Pass. Operating Current (A): 0.4, 0.6; Derating Amount: 0.03, 0.075; Result: Pass. Thermal Temperature (°C): 85, THS-(25~10); Value: 60.063; Since it is less than THS-(25~10), result: Pass.
Capacitors C1, C2012N102N101T: Operating Voltage (V): 100, 0.6; Derating Amount: 29, 0.299; Result: Pass. Maximum Rated Ambient Temperature (°C): 125, TAM-10; Value: 60; Since it is less than TAM-10, result: Pass.
◆ FMEA Analysis Report: a) Determine the product structure and break down the entire device into multiple functional blocks according to the reliability block diagram. b. Select an appropriate reliability database; the reference value for device failure rate λref can be obtained by consulting Siemens’ database SN 29500, or it can be obtained from the manufacturer ； The required confidence level for the calculations is 70%; if the confidence level provided by the manufacturer is 60%, an adjustment is necessary: λ70% = λ60% × 1.204 / 0.917. c) Determine the environmental conditions (such as temperature, pressure, etc.): During FMEA analysis, it is necessary to use actual data on voltage, current, temperature, etc., related to the device’s operation, and refer to Siemens’ database in order to calculate the actual failure rate λ. d. Referring to the device failure modes and their respective proportions in Appendix D of IEC 62061, calculate the total failure rate for each functional block as well as the Safety Failure Fraction (SFF). It is required that the SFF value for each functional block meet the corresponding SIL level. Table 2 Calculation of Functional Block Safety Failure Scores: Number of IDs, Specifications, Function, Failure Mode, Impact of Failure, Hazard Criteria, Diagnostic Measures
DC λ λs λD λDD λDU SFF U6 1 MAX3256 Full bridge Open circuit No impact or output deactivation; enters safe state 0 None 0 16.4 3.28 3.28 0 0 Short circuit between any two terminals No impact or output deactivation; enters safe state 0 None 0 3.28 0 0 0 Stuck condition No impact or output deactivation; enters safe state 0 None 0 3.28 0 0 0 Output parasitic oscillation Loss of safety function 1 None 0 0 3.28 0 3.28 Value change No impact or output deactivation; enters safe state 1 None 0 3.28 0 0 0
C62 2 0603 5% Filtering Open circuit No impact 0 None 0 44 14.67 0 0 0
C43 CL10F101 Short circuit F3 Open circuit: output deactivation; enters safe state 0 None 0 14.67 0 0 0 Value change No impact 0 None 0 14.67 0 0 0
Total 60.4 57.12 3.28 0 3.28 0.9457
◆ DC-Diagnostic Coverage: The diagnostic coverage depends on the measures taken; its values are approximately 60%, 90%, and 99%. Tables A.2 to A.15 of IEC 61508-2 specify the techniques and measures recommended for diagnostic testing. The reliability block diagram of the digital input dual-output safety barrier is shown in Figure 3. In accordance with the latest requirements for certified engineers in Germany, relays must be evaluated as separate functional blocks and included in the FMEA analysis. There is a common cause failure between the power supply and the input; calculate PFD and PFH. http://yunrun.com.cn/upload/201804/25/201804252058206101.png Figure 2 Reliability block diagram and PFD calculation ◆ Fault insert Test The FIT test is used by certification bodies to verify the accuracy of FMEA reports. If the results of the FIT test differ from those in the FMEA, it is necessary to return to the design phase for modifications, or adjust the FMEA report based on the actual test results, recalculate the safety failure score and failure rate, and determine the SIL level. ◆ Performance testing and EMC/environmental testing: In accordance with GB 3836 requirements, safety barriers must undergo strict type testing ； Meanwhile, in accordance with VVP requirements, the safety barrier must undergo full-system performance testing to verify the implementation of its safety functions. The EMC testing items, reference standards, and test levels for safety barriers with functional safety are based on the requirements of IEC 2061 Appendix E; enhanced testing requirements apply to the tests for static discharge, electrical fast transient pulses, and surges. ◆ For safety barriers with functional safety requirements, their system documentation must meet both the requirements of the management system and IEC 1508, in order to ensure that all tasks are carried out accurately throughout the safety lifecycle. ◆ Design Manual: The design manual is a fundamental document created to implement the design functions; it includes information on the enclosure, structural requirements, principles, specifications, and functions, and is presented in graphical form as much as possible in accordance with standard requirements. ◆ Verification report: Verification is an internal inspection activity carried out by the manufacturer after completion of assembly, including electrical safety compliance verification reports and boundary value test reports. ◆ Production requirements are the specifications established by manufacturers to achieve certain functions, including functional requirements, safety requirements, environmental requirements, and so on. ◆ User Manual: The user manual is a document that provides information on the product’s specifications, functions, installation and operation, as well as testing procedures. It includes safety warnings, operating instructions, and troubleshooting tips. The purpose of reviewing management documents is to determine whether the means and criteria for meeting safety requirements are sufficient and reasonable, whether the content of the documents meets the needs of various stages in the safety lifecycle, and whether they can provide a basis for conducting functional safety certification. Once all the above documents have passed the review, the certification body will arrange for the issuance of the instrument functional safety certificate. At present, there are already many functional safety research institutions and related testing organizations, such as the Shanghai Institute of Automation Instruments and the Comprehensive Technical and Economic Research Institute for Instruments and Meters in the machinery industry, which have begun to offer functional safety certification services in China. With an increasing number of professionals and rising skill levels, functional safety certification for safety barrier instruments can now be carried out domestically. There are significant differences in practices and perceptions among various organizations; it is recommended that everyone study IEC 6508 in depth, take into account the actual characteristics of their company’s products, and avoid adhering to fixed templates, so as to obtain a functional safety certificate as soon as possible. Author: Zhang Hongyun