1

SIL norms define different rules that must be applied to code (i.e. : cyclomatic complexity, etc.)

These rules are defined by "NA - Non Applicable", "R - Recommended" and "HR - Higly Recommended".

I understand this appreciation is up to the people that define the software.

How constrained am I to follow the "R" rules from the "HR" rules ? Are the first one recommended and the second mandatory ?

2 Answers2

1

It is not clearly defined in the standards, so it is subject to interpretation by the certification authority. There are also variations in interpretation between standards (e.g. IEC 61508 vs EN 50128)

Most auditors would consider HR mandatory without some documented justification.

R is generally considered optional, but you generally need to select some of those options. (As opposed to optional meaning "can be ignored")

JeffP
  • 1,086
  • 8
  • 12
  • 1
    Are you saying that the certification is subjective depending on the certiifcation authority? –  Jul 04 '17 at 08:20
  • 1
    It is more correct to say that certification is a negotiation with a given certification authority, but yes there is definitely a subjective element. – JeffP Jul 05 '17 at 19:22
0

IEC 61508-3:2010, Annex A gives the following definitions:

  • HR: "the technicque or measure is highly recommended for this safety integrity level. If this technicque or measure is not used then the rationale behind not using it should be detailed with reference to Annex C during the safety planning and agreed with the assessor."

  • R: "the technique or measure is recommended for this safety integrity level as a lower recommendation to a HR recommendation." (sic!)

  • --: "the technique or measure has no recommendation for or against being used."

  • NR: "the technique or measure is positively not recommended for this safety integrity level. If this technique or measure is used then the rationale behind using it should be detailed with reference to Annex C during the safety planning and agreed with the assessor."

The assessor is the representative of the certification authority, so it is really about convincing the certifier.

As far as I know, in theory there is no absolutely mandatory or forbidden rating, but it is quite easy to overload oneself with extra measures necessary to make some untypical, unrecommended strategy convince the certifier, that "HR" is quite close to "mandatory" and "NR" is quite close to "forbidden".

"R" is not as close to "mandatory", but often it is enough to show the certifier that a concept is made that takes into account the detail tables - and to take responsibility (!) that this concept is implementing a reasonable substitute for the "more typical" measure which has not been applied.

HelpingHand
  • 1,294
  • 11
  • 27