AADvance Safety Manual - Tuv-fs.com

Chapter 5 AADvance Functional Safety SystemImplementationWhere the interaction does not fall within these categories, the affects of incorrectvalues and sequences of values shall be considered and measures taken to ensure thatthe system will respond safely in the event of erroneous data. Alternatively, measuresmay be implemented within the application to ensure the integrity and validity of thedata.Program TestingEven with a small number of inputs, it is possible to reach a point where the number oftests becomes unreasonable. Eliminating impossible or unlikely scenarios should beused to reduce the number of logic path tests that need to be performed. Theselection of what constitutes a scenario that does not require testing can be performedonly after a suitable hazard analysis.The scenarios should include possible plant conditions, sequences of plant conditions,and system conditions including partial power conditions, module removal and faultconditions.Where it is not possible to define a representative suite of test cases, all permutationsof input conditions, i.e. all possible states on all possible inputs, shall be exercised.Where the logic includes memory or timing elements, additional tests shall be definedto exercise all the possible sequences of input permutations leading to their operation.All safety-related functions shall be tested and the results of the tests recorded.The tests shall include the system scan time, fault detection time, fault reaction timeand throughput delay for shutdown logic. The system scan time, including Peer-to-PeerCommunications where appropriate, shall be less than ½ PST.Functional testing of all safety related programs is considered to be 100% if: All inputs are exercised through their entire allowable range All outputs are exercised through their entire program determined range All logic paths are exercised All timers have been tested regarding their timing characteristics without changingtiming parameters All combinatorial permutations of digital signals, with the exception of 100% testedfunction blocks, are tested, including fault states. All combinatorial permutations of analogue signals, with the exception of 100%tested function blocks, are tested within the safety accuracy granularity. All timing properties of each safety loop have been verifiedDocument number 553630 Issue 7: February 2010 5-31