Certification Report of the STT25S Temperature Transmitter Revision No.: 1.2 Date: Report Number: Product: Customer: Order Number: Authority: Responsible: 2009-Jul-10 SAS-135/2006T STT25S Temperature Transmitter Honeywell International Inc. Honeywell Field Solutions 512 Virginia Drive Fort Washington, PA 19034, USA M.IB5.03.085.05.SLA Digital Control & Communication Systems Section Computer Based Systems Software & Electronics Laboratory Halderstr. 27 Dipl. Ing. (FH) Josef Neumann Functional Safety Manager Reviewer: Josef Neumann Dipl.-Ing. Gerhard M. Rieger Branch Manager Gerhard Rieger This document is only valid in it s entirety and separation of any part is not allowed.
Content Page 1 Subject of certification... 3 2 Basis of certification... 4 3 Standards... 5 4 Definitions... 6 5 Overview about the system configuration... 7 5.1 Primary Safety Functions... 9 5.2 Secondary Safety Functions... 9 5.3 Logic Solver Inputs... 10 6 Hardware and software identification... 10 7 Documentation... 10 8 Assessment activities and results... 13 8.1 Development Process... 13 8.2 System Architecture... 16 8.3 Proven In Use... 17 8.4 Hardware Design and FMEDA... 18 8.5 Software Design and Implementation... 23 8.6 Verification and Validation... 23 8.7 Safety Manual... 24 9 Summary... 25 History: Rev. Description Name Date 1.0 Initial issue for HART 6 communication J. Neumann 2007-Oct-16 1.1 Modification for hardware C J. Neumann 2009-Jun-16 1.2 Revised configuration data J. Neumann 2009-Jul-10 Page 2 of 25
1 Subject of certification This report compiles the results of the assessment of the STT25S Temperature Transmitter of Honeywell International Inc. Honeywell International Inc. ordered the services of (thereafter known has TÜV NORD SysTec) to certify the STT25S Temperature Transmitter because of its use in safety-relevant applications by the process industry (e.g. oil & gas and chemical industry) with the goal of achieving a successful approval of STT25S Temperature Transmitter in the framework of the certification of safety-components. The STT25S Temperature Transmitter is to be certified in accordance with IEC 61508 for single use in Safety Integrity Level 2 (SIL 2) applications. The development and software process should be certified in accordance with SIL 3 requirements allowing the use of dual redundant STT25S Temperature Transmitters in SIL 3 applications. The STT25S Temperature Transmitter use HART 6.2 communication protocol. The Honeywell International Inc. STT25S Temperature Transmitter is based upon the standard STT250 Smart Temperature Transmitter which already has a documented history starting at 1996 for the proven in use consideration under IEC 61508, the new industry standard for safety electronic systems. Page 3 of 25
2 Basis of certification An effective assessment in order to meet all the requirements for a complete certification requires the following testing segments to be successfully completed: Functional Safety Management (FSM) Development process Architecture Safety system structure Hardware design Software design and implementation Proven in use verification and validation Test specification Including the following principal functional safety considerations: Hardware failure-behaviour Software failure-avoidance Probabilistic and Common Cause consideration Safety Manual Page 4 of 25
3 Standards Because of the application area of the STT25S Temperature Transmitter, the following standard is relevant: Functional Safety IEC 61508 IEC 61508-1:1998 IEC 61508-2:2000 IEC 61508-3:1998 Functional safety of electrical/electronic/programmable electronic safety-related systems Part 1: General Requirements General definitions: Type B, Low Demand Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems, Required SIL 2 Part 3: Software requirements Required SIL 3 Page 5 of 25
4 Definitions FIT FMEDA FSM HART Low demand mode PFD PFDAVG SFF SIL SRS Type A component Type B component λ du Failure In Time (1 * 10-9 failures per hour) Failure Mode Effect and Diagnostic Analysis Functional Safety Management Highway Addressable Remote Transducer Mode, where the frequency of demands for operation made on a safety-related system is no greater than one per year and no greater than twice the proof test frequency Probability of Failure on Demand Average Probability of Failure on Demand Safe Failure Fraction Safety Integrity Level Safety Requirements Specification Non-Complex component (using discrete elements); for details see 7.4.3.1.3 of IEC 61508-2 Complex component (using micro controllers or programmable logic); for details see 7.4.3.1.3 of IEC 61508-2 Dangerous Undetected (DU) Failure Rate [1/h] Page 6 of 25
5 Overview about the system configuration The STT250 series temperature transmitters are microprocessor-based units that accept a wide variety of inputs: Thermocouple sensor inputs 2 wire types B, E, J, K, N, R, S, T. RTD sensor inputs 2-, 3- or 4- wire -- types Pt100, Pt100J and Pt200. MilliVolt and Ohms sensor inputs are also accepted. The transmitter is 2-wire loop powered and gives a 4-20mA output signal linearized to temperature over the 2 loop wires. Lead wire compensation is provided for RTDs (Resistance Temperature Detectors) and internal digital cold junction compensation is provided for thermocouples. The new STT25S supports the HART communications protocol version 6.2 for ease of configuration and maintenance checking of sensor integrity via any of the listed HART Communication Foundation tools. Page 7 of 25
I/P 1 I/P 2 I/P 3 Current Source 3 / 4 Wire Detect VRef ADC AD7714 INPUT Board 2.8V Linear Reg. MAX8863 DC/DC I/P 4 OPTOS HCPL-070A CJC VSPM Vd SPI OTP EPROM AT27LV256 ADD Low Data D-Latch 74373 ADD High Custom PROCESSOR SC514806CPB1 Watchdog Timer MAX6746 CE Monoshot Circuit RESET MC68L711E9 Replacement OUTPUT Board PWM Output Chip - II SCI HART Modem 12197-503 4 20 ma V+ V- Figure 1: STT25S Block Diagram Page 8 of 25
The input board is dedicated to measurements and A/D conversion. It includes a 16-bit sigma-delta A/D converter, a precision current source for RTD measurements, an isolated DC/DC converter, and 3 optocouplers. The isolated DC/DC converter and the optocouplers provide a galvanic isolation of 500 V between the input and output sections. The output board is dedicated to supervision and communication. It includes a custom Motorola 68HC11 microcontroller and a custom Honeywell integrated circuit Output chip 2 controlling the 4-20 ma loop. Also includes a Hart modem chip along with its associated external passive components. Along with these two boards there is a third board which is a Shield board. The shield board consists mainly of a large, floating ground plane, used to protect the input and output boards against EMI (in conjunction with the metallization of the internal side of the case). Six feed-through capacitors connect the signals to the input board through the shield. The shield board also supports the cold junction temperature sensor 5.1 Primary Safety Functions The Honeywell International Inc. STT25S Temperature Transmitter measures the process temperature and reports the measurement within a safety accuracy of 2%. 5.2 Secondary Safety Functions The Honeywell International Inc. STT25S Temperature Transmitter performs automatic diagnostics to detect internal failures and reports these failures via out of band signals on the 4 20 ma output. Page 9 of 25
5.3 Logic Solver Inputs The logic solver must be configured so that the engineering range in the transmitter matches the expected range of the logic solver. To take advantage of the internal diagnostics in the STT25S Temperature Transmitter, the logic solver must be configured to annunciate an out of band current reading (greater than 20.8 ma. or less than 3.8 ma.) in standard instrument or (greater than 21.0 ma. or less than 3.6 ma.) with Namur option as a diagnostic fault. The logic solver configuration must consider the slew time of the current signal and ensure that filtering is used to prevent a false diagnostic failure annunciation. 6 Hardware and software identification The following versions are considered for the certification: Hardware Schematic: 50015953, C, 2009-06-29 Hardware Layout: 50015951-001-A Software: Rev. 1.0 7 Documentation The evaluation is based on the following documents of the STT25S Temperature Transmitter: [D1] Project Plan, Vers. 2.3, 2007-08-24 [D2] Program Management Plan, Vers. 1.0, 2007-08-28 [D3] Team Competency Summary, Vers. 1.0, 2007 [D4] IEC 61508 Process Gap Analysis SIL 3, Vers. 1.1, 2005-12-07 [D5] STT25S SIL2 Enhancements, Vers. 1.0, 2005-12-16 [D6] IM&C New Product Development Process, Vers. A, 2006-09-07 [D7] Proven In Use Assessment, Vers. 1.1, 2007-08-20 [D8] Hardware Requirements Specification, Vers. 2.6, 2007-08-17 Page 10 of 25
[D9] Risk Management Plan, Vers. 1.1, 2007-08-28 [D10] Product Abstract, Vers. 1.0, 2007-08-15 [D11] Product Requirements Specification, Vers. 2.2, 2006-10-31 [D12] Software Requirements Specification, Vers. 3.3, 2007-09-04 [D13] High Level Design Hardware, Vers. 2.4, 2006-03-30 [D14] Hardware Maintenance Document, Vers. 1.1, 2007-07-27 [D15] Firmware Maintenance Document, Vers. 1.2, 2007-09-13 [D16] High Level Design (Software), Vers. 2.1, 2007-07-16 [D17] Hig Level Design Document for SIL 3 implementation, Vers. 1.9, 2007-09-04 [D18] PAC and SubPAC Phase Gate Review, Vers. A, 2004-06-03 [D19] Traceability Matrix, Vers. 0.5, 2007-08-23 [D20] Test Coverage Report, Vers. 1.1, 2007-02-06 [D21] Failure Modes, Effects and Diagnostic Analysis, Vers. 1.3, 2007-09-11 [D22] STT25S Phase Completion Status, Vers. 0.94, 2007-01-19 [D23] Code Review Checklist, Vers. 1.0, 2006-11-02 [D24] Product Test Plan, Vers. 1.0, 2007-08-28 [D25] System Test Plan, Vers. 2.4, 2007-08-23 [D26] Review of System Test Plan, Vers. 1.0, 2006-03-29 [D27] Unit Test Plan for HART 6.2 Implementation, Vers. 2.2, 2007-08-23 [D28] Unit Test Plan for SIL 3 Implementation, Vers. 2.2, 2007-09-05 [D29] Review Comments for Test Plans, Vers. 1.2, 2006-09-15 [D30] AMS Integration Test Plan, Vers. 1.2, 2007-03-22 [D31] EPKS-FDM System Test Plan, Vers. 1.2, 2006-10-10 [D32] Automated Test System Design, Vers. 3.0, 1999-06-10 [D33] Design Document for Automated Test System (Regression Test), Vers. 3.0, 1998-08-19 [D34] Environmental and Product Test Plan, Vers. 0.04, 2007-03-22 [D35] EMC Test Plan for STT25S, Vers. 1.5, 2006-04-12 [D36] EMC Test Plan with Results, Vers. 1.4.2, 2006-06-30 [D37] Fault Injection Testing, Vers. 0.3, 2007-09-14 Page 11 of 25
[D38] STT25S System Test Plans Results, Vers. 1.0, 2007-07-24 [D39] Unit Test Plan Results for HART 6.2 Implementation, Vers. 1.9.1, 2007-03-30 [D40] Unit Test Plan for SIL 3 Implementation Results, Vers. 2.2.1, 2007-09-13 [D41] Safety Manual, 31-ST-25-32, 03/2007 [D42] Schematic, 50015953, C [D43] Parts List, STT25s 6.0 Temperature Transmitter, 50015952-001 The assessment is based on the following documents of TÜV NORD SysTec: [D44] Offer for a type approval and certification of the STT25S Temperature Transmitter, Vers. 1.0, 2006-04-20 [D45] Protocol of the document reviews, Vers. 1.0, 2007-08-30 [D46] Fault injection test report for hardware, Vers. 1.0, 2007-08-30 [D47] Software Test Report for Software, Vers. 1.0, 2007-08-29 [D48] Checklist according IEC 61508, Vers. 1.0, 2007-09-10 [D49] Review of the modification for the hardware C, V1.0, 2009-06-11 Page 12 of 25
8 Assessment activities and results 8.1 Development Process General aspects and scope: In this step of assessment, a safety management audit has been performed to cover the relevant requirements of the IEC 61508, in respect of the fulfilment of the requirements to the safety quality procedures. The scope of the Functional Safety Management Audit covers the specified Safety Lifecycle Phases of the IEC61508. The scope for Honeywell International Inc. is as follows: For design, developing, manufacturing and integration of microprocessor based transmitters. For the Functional Safety Management Audit according to IEC 61508 it was essential that the functional safety management and the software development process are designed for the SIL 3 level to allow the set up of a redundant STT25S Temperature Transmitter system in a SIL 3 environment. The FSM procedures are used to reduce the systematic failure rate. Honeywell International Inc. has created the following documents to define the FSM activities: Project Plan [D1] Program Management Plan [D2] Product Abstract [D10] IM&C New Product Development Process [D6] Firmware Maintenance Document [D15] Within the project all safety relevant definitions are defined by the Functional Safety Management and the normative requirements. Page 13 of 25
Structuring of the development process: The documents [D1] [D2] [D6] [D10] [D15] describe the Honeywell International Inc. development processes, procedures and work-instructions. TÜV NORD SysTec visited the Honeywell International Inc. development site as an external assessment department, toured the facilities and interviewed the Safety Design Team in order to understand all the relevant corporate procedures. They then extracted the most important functional safety management requirements from the standards and prepared documents indicating needed enhancements of the standard processes. TÜV NORD SysTec has reviewed this document to discuss the overall FSM requirement activities for the project with Honeywell International Inc. TÜV NORD SysTec has than discussed the relevant items with Honeywell International Inc. in a meeting and reviewed the documents for the safety aspects of the system. Honeywell International Inc. is covering the following areas: Functional Safety Management Quality Management System Development of Safety Sub-Systems (Realization) Verification & Validation activities (Testing) The focus of the interview with Honeywell International Inc. was to demonstrate compliance with the appropriate sections of the IEC61508 standard. The following sections were considered: Specific Objectives for Functional Safety Change Management (Modification Process) Maintenance The reviews with Honeywell International Inc. were related to the following areas: Safety Requirement specification Safety Architectural Constrains Page 14 of 25
Safety Hardware Requirements Safety Software Requirements Proven In Use documentation Verification & Validation of Safety Products Safety Manual It was essential for the audit to discuss the safety aspects of the project with the participants and to ask for the relevant documents and to access all relevant information. Actual documentation from the STT25S Temperature Transmitter project was partly reviewed and the statements of the participants were compared with the relevant parts of the documents. Verification & Validation activities (Testing): For verification & validation the independent test engineers are responsible for all activities within this segment. They create the test specifications for specific projects used by the development engineers. The functional tests and integration and validation testing was done by independent test engineers. The test engineers must have specific knowledge about safety functions of the specific project. Internal training is therefore an important method to improve the knowledge of the test engineers. This could be proved by interviews and with reviews of examples of the corresponding documents. Result: The audits and document reviews performed from the 28 to 30 of August 2007 with Honeywell International Inc. have shown that the Functional Safety Management System, defined in the documents [D1] [D2] [D6] [D10] [D15] complies with the applicable sections of the IEC 61508. No major findings were detected in the audit. If changes to the Safety Management Systems are performed than TÜV NORD SysTec must be informed. Page 15 of 25
8.2 System Architecture The system documents [D13] to [D16] have been reviewed to verify compliance of the system architecture with the standard listed in clause 3 "Standards". Based on the set of requirements TÜV NORD SysTec has evaluated whether the implemented fault detection and fault control measures which are defined for the STT25S Temperature Transmitter were sufficient to meet the requirements. The system architecture was evaluated in regards to completeness and correctness against the Safety Requirements Specification and the System FMEDA. The system architecture have to be designed for a Type B subsystem according the IEC 61508-2 with a Safe Failure Fraction of 90% or higher. The FMEDA verified the defined safe state of the STT25S Temperature Transmitter in the event of possible malfunctions. Probable deviation from the specified function of the unit was also considered to be a malfunction. Result: The review from TÜV NORD SysTec has shown that the system architecture of the STT25S Temperature Transmitter is consistent against the Safety Requirements Specification. The specifications in the documentation are consistent and complete and clearly presented. The system concept with the chosen architecture design and the selected measures of fault detection and fault control is able to fulfill the Safety Integrity Level 2 with a Safe Failure Fraction of >90%. Page 16 of 25
8.3 Proven In Use For a device to be considered proven-in-use the volume of operating experience needs to be considered. For the Honeywell International Inc. STT25S Temperature Transmitter this information is obtained from the Operation Experience and Warranty Information. The Honeywell International Inc. standard STT250 Smart Temperature Transmitter was first introduced in January 1996. In this time period there have been no significant revisions or changes to the design. The operating experience and warranty information indicates that the total number of shipped units during this time period is 104,795. For failure rates calculated on the basis of field returns only the hours recorded during the warranty period of the manufacturer are used, since this is the only time frame when failures can be expected to be reported. It must be assumed that all failures after the warranty period are not reported to the manufacturer. Honeywell International Inc. offers a 12-mounth warranty period; this period starts on the date of shipment. Volume of operating experience must be based on installation dates and not on shipment dates. Since installation dates are not available it is assumed that the pressure transmitters are installed 6 months after shipment. Using this assumptions and restrictions the number of operational hours is estimated to be: Operation Hours = 793,755,528 hrs These operating hours are considered to be sufficient taking into account the medium complexity of the sub-system and the use in SIL 3 safety functions. In the calculation of the operation hours it is assumed that the units shipped include units up to a year before the field failure reporting hereby ensuring that all failures that occur to the included units are accounted for. Page 17 of 25
Result: The documented operating hours are considered to be sufficient for the use at SIL 2 or SIL 3 applications, depending on redundancy and the calculation of the PDF and SFF and taking into account the medium complexity of the subsystem. 8.4 Hardware Design and FMEDA A Failure Modes and Effects Analysis (FMEA) is a systematic way to identify and evaluate the effects of different component failure modes, to determine what could eliminate or reduce the chance of failure, and to document the system in consideration. A FMEDA (Failure Mode Effect and Diagnostic Analysis) is an extension of the FMEA. It combines standard FMEA techniques with additional analysis to identify online diagnostic techniques and the failure modes relevant to safety system design. It is a technique recommended to generate failure rates for each important category (detected, dangerous undetected, fail high, fail low, annunciation) in the safety model. The following assumptions have been made during the Failure Modes, Effects, and Diagnostic Analysis of the STT25S Temperature Transmitter: Only a single component failure will fail the entire product Failure rates are constant; wear out mechanisms are not included. Propagation of failures is not relevant. All components that are not part of the safety function and cannot influence the safety function (feedback immune) are excluded. The application program in the safety logic solver is configured to detect under-range (Fail Low), over-range (Fail High) and Fail Detected failures and does not automatically trip on these failures; therefore these failures have been classified as dangerous detected failures. Practical fault insertion tests can demonstrate the correctness of the failure effects assumed during the FMEDAs and the diagnostic coverage provided by the online diagnostics. Page 18 of 25
Transmitter is installed per the instructions and the requirements of the application. The stress levels are average for an industrial environment and can be compared to the Ground Fixed classification of MIL-HNBK-217F. Alternatively, the assumed environment is similar to IEC 60654-1, Class C with temperature limits within the manufacturer s rating and an average temperature over a long period of time of 30C. Humidity levels are assumed within manufacturer s rating. External power supply failure rates are not included. Worst-case internal fault detection time is assumed to be 48 hours. The specification for minimum loop voltage with installed accessories is increased per the Operator Manual. The following tables show the failure rates resulted from the Honeywell International Inc. STT25S Temperature Transmitter FMEDA [D21]. Table 1 and Table 2 list the failure rates for the STT25S. These failure rates do not include failure of the sensing devices. Failure category Failure rate (in FIT) Fail Dangerous Detected 351 - Fail Detected (detected by internal diagnostics) 298 - Fail High (detected by the logic solver) 20 - Fail Low (detected by the logic solver) 23 Fail Dangerous Undetected 41 Fail Safe Undetected 52 Residual Effect 101 Annunciation Undetected 10 Table 1 Failure rates STT25S Temperature Transmitter with RTD Input Page 19 of 25
Failure category Failure rate (in FIT) Fail Dangerous Detected 339 - Fail Detected (detected by internal diagnostics) 287 - Fail High (detected by the logic solver) 29 - Fail Low (detected by the logic solver) 23 Fail Dangerous Undetected 39 Fail Safe Undetected 52 Residual Effect 89 Annunciation Undetected 10 Table 2 Failure rates STT25S Temperature Transmitter with Thermocouple Input The failure rates that are derived from the FMEDA for the STT25S Temperature Transmitter are in a format different from the IEC 61508 format. Table 3 lists the failure rates for STT25S Temperature Transmitter according to IEC 61508, assuming that the logic solver can detect both over-scale and under-scale currents. It is assumed that the probability model will correctly account for the Annunciation Undetected failures. Otherwise the Annunciation Undetected failures have to be classified as Dangerous Undetected according to IEC 61508 (worst-case assumption). The No Effect and Annunciation Undetected failures are classified as safe and therefore need to be considered in the Safe Failure Fraction calculation and are included in the total failure rate. According to IEC 61508, also the Safe Failure Fraction (SFF) of the STT25S Temperature Transmitter should be calculated. The SFF is the fraction of the overall failure rate of a device that results in either a safe fault or a diagnosed unsafe fault. This is reflected in the following formula for SFF: SFF = 1 - גּ du / גּ total Device גּ sd גּ su גּ dd גּ du SFF STT25S with RTD Input 0 FIT 163 FIT 351 FIT 41 FIT 92.6% STT25S with Thermocouple Input 0 FIT 151 FIT 339 FIT 39 FIT 92.6% Table 3: Failure rates and Safe Failure Fraction according to IEC 61508 Page 20 of 25
In addition, the following accessories were evaluated: RMA300-ME mechanical meter; RMA300-SM digital meter; and SPD Surge Protection Device. The failure rates for these accessories are shown in Table 4 through Table 7. Failure category Failure rate (in FIT) Fail Dangerous Detected 1.5 - Fail High (detected by the logic solver) 0.3 - Fail Low (detected by the logic solver) 1.2 Fail Dangerous Undetected 0.0 Residual Effect 21.0 Table 4 Failure rates RMA300-ME Failure category Failure rate (in FIT) Fail Dangerous Detected 0.2 - Fail High (detected by the logic solver) 0.0 - Fail Low (detected by the logic solver) 0.2 Fail Dangerous Undetected 9.0 Residual Effect 10.5 Table 5 Failure rates RMA300-SM Failure category Failure rate (in FIT) Fail Dangerous Detected 14.1 - Fail High (detected by the logic solver) 10.5 - Fail Low (detected by the logic solver) 3.6 Fail Dangerous Undetected 1.0 Residual Effect 19.9 Table 6 Failure rates SPD Table 7 lists the failure rates according to IEC 61508 for the STT25S Temperature Transmitter fitted with each of these accessories, assuming that the logic solver can detect both over-scale and under-scale currents. It is assumed that the probability model will correctly account for the Annunciation Undetected failures. Otherwise the Annunciation Undetected failures have to be classified as Dangerous Undetected failures according to IEC 61508 (worst-case assumption). Page 21 of 25
Note that the Residual Effect failures of the accessories are not included in the calculation of the IEC 61508 values in order to avoid dilution. Device גּ sd גּ su גּ dd גּ du SFF STT25S with RTD Input and RMA300-ME 0 FIT 184 FIT 353 FIT 41 FIT 92.9% STT25S with Thermocouple Input and RMA300-ME 0 FIT 172 FIT 341 FIT 39 FIT 92.9% STT25S with RTD Input and RMA300-SM 0 FIT 175 FIT 351 FIT 50 FIT 91.3% STT25S with Thermocouple Input and RMA300-SM 0 FIT 162 FIT 339 FIT 48 FIT 91.3% STT25S with RTD Input and SPD 0 FIT 183 FIT 365 FIT 42 FIT 92.9% STT25S with Thermocouple Input and SPD 0 FIT 171 FIT 353 FIT 40 FIT 92.9% Table 7: Failure rates and Safe Failure Fraction according to IEC 61508 The architectural constraint type for the STT25S Temperature Transmitter is B. The SFF and required SIL determine the level of hardware fault tolerance that is required per requirements of IEC 61508. The SIS designer is responsible for meeting other requirements of applicable standards for any given SIL as well. The expected lifetime of the Honeywell International Inc. STT25S Temperature Transmitter is 50 years. The failure rates of the Honeywell International Inc. STT25S Temperature Transmitter may increase sometime after this period. When plant experience indicates a shorter useful lifetime, the number based on plant experience should be used. Result: With these results from the calculation it can be shown, that the STT25S Temperature Transmitter fulfils SIL 2 for the hardware design in a single configuration. Page 22 of 25
8.5 Software Design and Implementation The software of the STT25S Temperature Transmitter is based upon the standard ST250 Smart Pressure Transmitter and is considered to be proven in use according to the calculated operating hours. To provide the necessary internal testing of the hardware module to cover the IEC 61508 requirements for the Safe Failure Fraction (SFF) according SIL 2 additional tests has been implemented. This was done by adding software modules following the IEC 61508-3 SIL 3 process for software developing and implementation. These additional tests includes RAM and ROM testing and a flow control to reach a sufficient safe failure fraction > 90%. The corresponding documents have been reviewed by TÜV NORD SysTec. Result: The normative requirements out of the techniques and measures according to the IEC 61508-3 for software have been selected in the high level design of the software [D16] and considered for the development of the software. The software design and implementation and implemented measures are compliant to IEC 61508 part 3 according SIL 3. 8.6 Verification and Validation The verification activities are defined by the reviews of the documentation according the specific phases of the development model (V-model). The review documentation has been discussed with responsible engineers from Honeywell International Inc. and has been reviewed by TÜV NORD SysTec. The test specification defined in the System Test Plan [D25] from the manufacturer has been reviewed. The list of validation tests are referenced to the Requirement Specification. The review has shown that the requirements are covered by the validation plan. After the execution of the validation tests by the manufacturer [D24] to [D40], the test results have been reviewed by TÜV NORD SysTec. The test results are also referenced to the Design Specification. Page 23 of 25
Additional sample testing of the STT25S Temperature Transmitter have been defined by TÜV NORD SysTec and a separate list of test items has been generated. The defined of tests have been executed by TÜV NORD SysTec together with the manufacturer. The definition and results are documented in the Fault Injection Test Report for the STT25S Temperature Transmitter [D46] [D47]. Result: The review of the Integration Test Plan and the Test Reports from the manufacturer and the execution of the sample tests by TÜV NORD SysTec have shown that the defined tests are consistent to the Design Specification and the tested results can be compared to the tests of the manufacturer. The test definitions are sufficient to prove compliance with the standard. 8.7 Safety Manual The Safety Manual [D41] has been reviewed to fulfill the requirements of the considered standard. Specifically the section about Proof Testing has been checked according the defined measures to be followed up by the end user to be compliant with the considered standard according failure detection which are not covered by the diagnostic of the transmitter. Result: The review has shown that the Safety Manual meets the requirement of the considered standard. Detailed descriptions are included for the end user to install, operate and maintain the transmitter in the required safety level. Page 24 of 25
9 Summary The assessment of the STT25S Temperature Transmitter has shown that the system design, the safety functional management and the system structure are compliant with the IEC 61508, SIL 2 under consideration of the proven in use of the transmitter and the additional measures implemented to the transmitter. The defined development process of the software for modifications together with the proven in use consideration is in accordance with SIL 3 requirements allowing the use of dual redundant STT25S Temperature Transmitter in SIL 3 applications. The validation and testing activities has shown compliances between the realized transmitter implementation and the safety requirements specification. The actual version of the Safety Manual must be considered for the use in safety relevant applications. Page 25 of 25