329 / 975
4. Engineering best practices to reduce risk in application design
As indicated previously, best practices in design apply both in the design of a Commercial Off-the-Shelf (COTS)
Product and the Application Design or the application of a COTS tailored to reduce a particular risk in an
industrial installation.
Best Practices in Application Design will apply a model similar to the V-Model used in the development of a
product (Figure 3) and reinforced by a structured Quality Management system appropriate for Functional Safety
applications.
Application Design starts with Hardware Design following the COTS Product’s Safety Manual and considers the
particularities of the application as described on the Application Safety Requirements Specification to design a
system that is less susceptible to product failures by considering aspects such as:
§
Power feeds and Power Supplies
§
CPUs
§
I/O Modules Hardware
Application Software
§
Networks
4.1. Hardware
It is clear that hardware is not perfect, it is subject to failure, and the application design must consider failure
recovery modes or additional risk reduction methodologies or options including such diverse methods of
performing shutdowns as:
§
Hardwired pushbutton
§
Hardwired logic systems (with appropriate SIL rating)
§
Solid State relays, etc.
.
4.2. Software
One critical aspect that has gained visibility in recent years is the software design of the application. Efforts in
this area include the development of a well-documented Software Functional Design and appropriate selection
of software tools and libraries to meet the Safety Integrity Level (SIL) required for the application. Software
design also includes Code Review practices including Independent Validation and Verification depending on the
SIL, competence of the programmer and other elements described later in section 5.1. The features available in
the COTS product addressing the systematic capabilities requirements are a valuable asset for the programmer
and contribute to reducing potential errors that will later affect the safety of the installation.