Functional Safety 2014

vi) Possible dangerous implications

Particularly due to incorrect software techniques, wrong standard software

blocks, incorrect implementation:

•

High-high trip programmed using the high alarm output – no latch or override

•

Incorrect programming of energise to trip circuits – leading to spurious operation on

logic solver power-up or loss of communications.

•

Tripping of equipment not required to be tripped; typically resulting from changes not

fully implemented.

Counter-measures:

•

Competence and awareness

•

Familiarity with software library and system functionality

•

Verification measures

Neil Wakeling, August 2014