The PLUS+1 GUIDE program and the PLUS+1 Service Tool program fulfill the
requirements of International Electrotechnical Commission (IEC) standard 61508
for use as support tools in the development of Safety and Integrity Level 2 (SIL2)
application software. (Refer to SP Technical Research Institute of Sweden
certificate No. 46 24 01.)
standard 61508-3 defines all the requirements that must be fulfilled to
IEC
produce SIL2 application software. By using the PLUS+1 GUIDE program and
PLUS+1 Service Tool program during the application software design, some of
the requirements in IEC 61508-3 will be fulfilled. For a more detailed description
concerning which of the IEC 61508-3 requirements that are fulfilled or not, see
X
SIL2 Certification RequirementsX on page X13X.
the
Click
SIL2 certification
The About PLUS+1 GUIDE window indicates if the version of the PLUS+1
GUIDE program that you are using is SIL2 certified.
Warning
Changing files in a PLUS+1 GUIDE project with any program other than the PLUS+1
GUIDE program can produce an application that operates in an unpredictable and
possibly dangerous manner. It also voids SIL2 certification for the application.
Only use the PLUS+1 GUIDE program to make changes to files in a PLUS+1 GUIDE
project.
12
11070058 · Rev FG · April 2009
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
2
SIL2 Certification Requirements
The following tables:
•Identify, clause by clause, the software quality management system and
software safety lifecycle requirements in the 61508-3 standard that must be
fulfilled to produce a SIL2 certified application.
•Show the requirements that are either completely fulfilled or partially fulfilled
by using the PLUS+1 GUIDE program and PLUS+1 GUIDE Service Tool
program.
X
• Also see
6.0 Software quality management system
Clause Fulfill Comments
6 No The PLUS+1 GUIDE software tool does not handle the necessary software quality management system.
Additional SIL2 Certification RequirementsX on page X20X.
7.0 Software safety life cycle requirement
Clause Fulfill Comments
7.0 No The software safety life cycle requirements are partly fulfilled by using the PLUS+1 GUIDE software tool.
7.1 General
Clause Fulfill Comments
7.1 No This requirement structures the development of the software into defined phases and activities.
The PLUS+1 GUIDE software tool does not fulfill this requirement.
7.2 Software safety requirements specification
Clause Fulfill Comments
7.2 No These requirements are related to the application created with the PLUS+1 GUIDE software tool.
The PLUS+1 GUIDE software tool does not fulfill this requirement.
7.3 Software safety validation planning
Clause Fulfilled Comments
7.3 No These requirements are related to the application created with the PLUS+1 GUIDE software tool.
The PLUS+1 GUIDE software tool does not fulfill this requirement.
11070058 · Rev FG · April 2009
13
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
7.4.2 General requirements
Clause Fulfill Comments
7.4.2.1 See clauses
7.4.2.2–
7.4.2.12
7.4.2.2 Yes The PLUS+1 GUIDE software tool possesses features that facilitate references (a) to (d) as described in
7.4.2.3 Partial The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool program provide sufficient means
7.4.2.4 Yes The graphical coding environment in the PLUS+1 GUIDE software tool includes features that facilitate
7.4.2.5 Yes The design representation is interpreted as a high-level design description. The notation is defined as the
7.4.2.6 No The software application designer, who uses the PLUS+1 GUIDE software tool, has the responsibility to
7.4.2.7 Yes* If the software is to implement both safety and non-safety functions, then all of the software shall be treated
7.4.2.8 Yes* If the software is to implement safety functions of different safety integrity levels, then all of the software
7.4.2.9 No The software application designer has the responsibility to include software functions to execute proof tests
7.4.2.10 No The software application designer has the responsibility to include software functions for self-monitoring of
7.4.2.11
N/A Handwritten C code is not allowed to link to the PLUS+1 GUIDE software tool.
(1)
7.4.2.11
Yes The software application designer is responsible for requirements regarding re-use of graphical code. A
(2)
7.4.2.12 No The software application designer has the responsibility to identify any data (software parameters, for
The user of the PLUS+1 GUIDE software tool and the software tool itself share the responsibility for
software design and development.
This table describes how responsibilities for the requirements in clause 7.4.2 divide between the user of the
PLUS+1 GUIDE software tool and the software tool itself.
clause 7.4.2.2.
The software application designer has the responsibility to utilize these possibilities.
to enable testability and capacity for safe modifications as a design aspect.
The software application designer has the responsibility to utilize these possibilities.
software modifications. Such features include modularity, information hiding, and encapsulation.
available graphical components. The PLUS+1 GUIDE User Manual clearly defines these graphical
components.
minimize the safety-related part of the software.
as safety related, unless adequate independence between the functions can be demonstrated in the design.
*If the software application designer wishes to separate safety and non-safety functions when using the
PLUS+1 GUIDE software tool, the only possibility is to either use more than one hardware unit in the
system or put the non-safety related part in a separate module.
shall be treated as belonging to the highest safety integrity level, unless adequate independence between
the safety functions of the different safety integrity levels can be shown in the design. The justification for
independence shall be documented.
*If the software application designer wishes to separate safety functions with different safety integrity levels
when using the PLUS+1 GUIDE software tool, the user only has the possibility to put the non-safety related
part in a separate module.
and diagnostic tests (these are functional properties).
control flow and data flow and to take appropriate actions when failures are detected.
tested and verified graphical source can be re-used without testing when moved from another hardware
platform.
example) influencing the application.
14
11070058 · Rev FG · April 2009
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
7.4.3 Requirements for software architecture
Clause Fulfill Comments
7.4.3.1 See clauses
7.4.3.2–
7.4.3.3
7.4.3.2 No The software application designer has the responsibility to develop a description of the software design
7.4.3.3 No The software application designer has the responsibility to decide whether any changes are required to
7.4.4 Requirements for support tools and programming languages
The user of the PLUS+1 GUIDE software tool and the software tool itself share the responsibility for
software design and development.
Clause 7.4.3 is divided between the user and the tool. This table describes the responsibility for handling
these requirements.
architecture. However, it is possible to extract relevant parts of the application program architecture
description from the PLUS+1 GUIDE software tool.
specified safety requirements and to agree to these changes with the hardware developer.
Clause Fulfill Comments
7.4.4.1 See clauses
7.4.4.2–
7.4.4.6
The user of the PLUS+1 GUIDE software tool and the software tool itself share the responsibility for
software design and development.
This table describes how the responsibility for handling the requirements in clause 7.4.4 is divided between
the user of the tool and the tool itself
7.4.4.2 Partial The PLUS+1 GUIDE User Manual describes the integrated tools within the PLUS+1 GUIDE software tool.
7.4.4.3 Yes The tool has been certified. Please refer to SP Technical Research Institute of Sweden certificate No. 46 24
01.
7.4.4.4 No This requirement does not need to be further considered because the PLUS+1 GUIDE software tool
satisfies the requirements in 7.4.4.3.
7.4.4.5 No Coding standards.
The assessor and the software application designer are responsible for this requirement.
7.4.4.6 Partial The PLUS+1 GUIDE software tool coding guidelines specify that coding standards should use good
programming practices and proscribe unsafe language features, but it is the responsibility of the software
application designer to use the coding guidelines and specify procedures for source code documentation.
11070058 · Rev FG · April 2009
15
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
7.4.5 Requirements for detailed design and development
Clause Fulfill Comments
7.4.5.1 See clauses
7.4.5.2–
7.4.5.5
7.4.5.2 No Information should be available prior to the start of detailed design. This includes the specification of
7.4.5.3 Partial The software should be produced to achieve modularity, testability, and the capacity for safe modification.
7.4.5.4 Partial For each major component/subsystem in the description of the software architecture design, further
7.4.5.5 Partial Appropriate software system integration tests should be specified to ensure that the software system
7.4.6.1 Partial The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool program provide sufficient means
7.4.6.2 No Each module of software code should be reviewed.
The user of the PLUS+1 GUIDE software tool and the software tool itself share the responsibility for
software design and development.
This table describes how the responsibilities for requirements in clause 7.4.5 divide between tithe PLUS+1
GUIDE software tool and the software tool itself.
requirements for software safety, the description of the software architecture design, and a plan for
validating the software safety.
The software application designer is responsible for this requirement.
The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool provide sufficient means to enable
testability and capacity for safe modifications as a design aspect.
The software application designer has the responsibility to utilize these possibilities.
refinement of the design shall be based on a partitioning into software modules (for example, the
specification of the software system design). The design of each software module and the tests to be
applied to each software module shall be specified.
The PLUS+1 GUIDE software tool supports modular design of the application software. The PLUS+1
GUIDE software tool and the PLUS+1 GUIDE Service Tool provide sufficient means to enable the testing of
individual software modules.
The software application designer is responsible for specifying the design of each software module and for
the tests to be applied to each software module.
satisfies the specified requirements for software safety at the required safety integrity level.
The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool program provide sufficient means
to enable integration tests.
The software application designer is responsible for specifying appropriate software system integration
tests.
to enable testability and capacity for safe modifications as a design aspect to enable the requirements of (a)
to (b) of this clause.
The software application designer is responsible for implementing the source code requirements as
described in sections (a) to (d) of this clause.
The assessor and software application designer are responsible for this requirement.
16
11070058 · Rev FG · April 2009
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
7.4.7 Requirements for software module testing
Clause Fulfill Comments
7.4.7.1 Partial Each software module shall be tested as specified during software design.
The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool program provide sufficient means
to enable the testing of individual software modules.
The software application designer is responsible for testing each software module.
7.4.7.2 Partial These tests shall show that each software module performs its intended function and does not perform
unintended functions.
The PLUS+1 GUIDE software tool has flexible means to support modular testing of functions.
The software application designer is responsible for the testing requirements.
7.4.7.3 No The results of the software module testing shall be documented.
The software application designer is responsible for this requirement.
7.4.7.4 No The procedures for corrective action on failure of test shall be specified.
The software application designer is responsible for this requirement.
7.4.8 Requirements for software integration testing
Clause Fulfill Comments
7.4.8.1 No Software integration tests shall be specified concurrently during the design and development phase.
The software application designer is responsible for this requirement.
7.4.8.2 No The specified software integration tests shall specify a number of items.
The software application designer is responsible for this requirement.
7.4.8.3 Partial The software shall be tested in accordance with the specified software integration tests. These tests shall show
that all software modules and software components/ subsystems interact correctly.
The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool program provide sufficient means to
enable the integration tests.
The software application designer is responsible for performing the integration tests.
7.4.8.4 No The results of software integration testing shall be documented, stating the test results, and whether the
objectives and criteria of the test criteria are met. If there is a failure, the reasons for the failure shall be
documented.
The software application designer is responsible for this requirement.
7.4.8.5 No During software integration, any modification or change to the software shall be subject to an impact analysis that
shall determine all the software modules impacted, and the necessary re-verification and re-design activities.
The software application designer is responsible for this requirement.
11070058 · Rev FG · April 2009
17
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
7.5.2 Programmable electronics integration (hardware and software)
Clause Fulfill Comments
7.5.2.1 No Integration tests shall be specified during the design and development phase to ensure the compatibility of the
hardware and software in the safety-related programmable electronics.
The software application designer is responsible for this requirement.
7.5.2.2 No The integration tests for programmable electronics (hardware and software) shall specify the number of items.
The software application designer is responsible for this requirement.
7.5.2.3 No The specified integration tests for programmable electronics (hardware and software) shall distinguish between
those activities which can be carried out by the developer on his premises and those that require access to the
user’s site.
The software application designer is responsible for this requirement.
7.5.2.4 Partial The specified integration tests for programmable electronics (hardware and software) shall distinguish between a
number of activities.
The PLUS+1 GUIDE software tool only provides sufficient facilities to perform integration tests according to
requirement (a) of this clause.
7.5.2.5 No The software shall be integrated with the safety-related programmable electronic hardware in accordance with the
specified integration tests for programmable electronics (hardware and software).
The software application designer is responsible for this requirement.
7.5.2.6 No During the integration testing of the safety-related programmable electronics (hardware and software), any
modification or change to the integrated system shall be subject to an impact analysis which shall determine all
software modules impacted, and the necessary reverification activities.
The software application designer is responsible for this requirement.
7.6 Software operation and modification procedures
Clause Fulfill Comments
7.6 No The software application designer is responsible for this requirement.
7.7. Software safety validation
Clause Fulfill Comments
7.7.2.1 No If the compliance with the requirements for software safety has already been established as part for the
E/E/PE safety-related system (see IEC 61508-2, clause7.7), then the validation need not be repeated.
The software application designer is responsible for this requirement.
7.7.2.2 No The validation activities shall be carried out as specified during software safety validation planning.
The software application designer is responsible for this requirement.
7.7.2.3 No The results of software safety validation shall be documented.
The software application designer is responsible for this requirement.
7.7.2.4 No For each safety function, software safety shall be documented according to results (a) through (f) of this
clause.
The software application designer is responsible for this requirement.
18
11070058 · Rev FG · April 2009
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
7.7. Software safety validation
Clause Fulfill Comments
7.7.2.5 No When discrepancies occur between expected and actual results, the analysis made and the decision taken
on whether to continue the validation or to issue a change request and return to the earlier part of the
development life cycle shall be documented as part of the results of the software safety validation.
The software application designer is responsible for this requirement.
7.7.2.6 Partial The PLUS+1 GUIDE software tool and the PLUS+1 GUIDE Service Tool program shall provide sufficient
means to support software validation at the software application level (tests that could be performed are
limited to available symbols and the information available in the API)
The PLUS+1 GUIDE software tool meets requirement (b) but not (a) or (d) of this clause.
7.7.2.7 No Software tool qualification requirements are as follows:
A. All equipment used for validation shall be qualified according to a specification traceable to an
international standard (if available), or to a national standard (if available), or to a well recognized
procedure.
B. Equipment used for software validation shall be qualified appropriately and any tools used, hardware or
software, shall be shown to be suitable for purpose.
The software application designer is responsible for this requirement.
7.7.2.8 No Software validation result requirements are as follows:
A. The tests shall show that all of the specified requirements for software safety (see clause7.2) are
correctly performed and the software system does not perform unintended functions.
B. Test cases and their results shall be documented for subsequent analysis and independent assessment
as required by the safety integrity level (see IEC 61508-1, clause 8.2.12)
C The documented results of software safety validation shall state either that the software has passed the
validation or the reasons for its failure.
The software application designer is responsible for this requirement.
7.8 Software modification
Clause Fulfill Comments
7.8 No The user writing the graphical application is responsible for this requirement.
7.9 Software verification
Clause Fulfill Comments
7.9 No The user writing the graphical application is responsible for this requirement.
8.0 Functional safety assessment
Clause Fulfill Comments
8.0 No The assessor of the safety critical product is responsible for this requirement.
11070058 · Rev FG · April 2009
19
PLUS+1 GUIDE
ユーザーマニュアル
IEC 61508 SIL2 Certified Code Generation Tool
3
Additional SIL2 Certification Requirements
When using the PLUS+1 GUIDE software tool, these additional requirements
must also be fulfilled to produce a SIL2 certified application.
1. Minimize, as much as possible, the use of read-only and read/write
parameters. Especially minimize the use of parameters that affect application
behavior.
2. In any application that uses a downloadable read-only parameters file, the
output of the Parameter Open component must be used to ensure that the
parameters file is correct for the application.
3. Analyze and document if output signals can overflow. Determine what
actions should occur in cases of overflow. This applies to both capped and
non-capped components.
4. A SIL2 application must use the SIL2 Certified component to indicate the
fulfillment of requirements for a SIL2 certified application. If the requirements
are not fulfilled, the application shall not be started.
5. Analyze and document error handling and how the application implements
error handling.
6. Analyze and document that the application minimizes the risk in startup
situations that involve initializing variables and outputs.
7. Analyze and document that the application minimizes the risk involved in
write delays to non-volatile memory.
インドウ>General(一般)>Pop-up Editor window for components(コンポー
ネント用ポップアップ編集)のチェックとなっています。
C
A
A
D
A
B
/
E
6. Edit Value ウインドウを使用して 3 Digit Auto-type 定数と Time Base 定数に数値を
与えます。
A. ツールバーの Query/Change ボタンをクリックします。
B. 一番上の定数の中にある ? をクリックして Edit Value ウインドウを表示します。
C. 表示された Edit Value ウインドウで、10 を入力します。
D. / を押して、この定数に 10 を設定します。
E. 上の図に示された他の定数に値を設定します。