Description

KONGSBERG RAo-8 X1 ANALOG OUTPUT 8100153 REV E2 (NEW OPEN BOX)　　KONGSBERG MARITIME AS　　RAo-8　　PART#: 8100153　　X1 ANALOG OUTPUT　　REV: E2　　HA451672A　　SN: 15721　　Scope Object of this type approval are the changes performed on the AIM Safe System from company Kongsberg Maritime. The AIM Safe System has previously been type approved by the Test Institute. The last approved version is AIM release 8.3.3, see /T5/. The main change is the introduction of a new controller module called RCU502 intended to replace the current controller module RCU501. The different software components of the AIM Safe System have been modified for the introduction of the new controller. Further bug fixes and minor upgrades of the software functionality have been performed. It shall be inspected whether the modified AIM Safe System still fulfils the requirements up to SIL 3 according to IEC 61508 for the use in safety related applications with a low demand mode of operation.Standards forming the basis for the requirements /N1/ IEC 61508 Part 1 to 7:2010 Functional safety of electrical/electronic/programmable electronic safety-related systems /N2/ IEC 61511, Part 1 to 3, 2003 and 2004 Functional safety – Safety instrumented systems for the process industry sector /N3/ IEC 60945:2002+Cor.1:2008 (for environmental testing) Maritime navigation and radio communication equipment and systems – General Requirements – Methods of testing and required test results /N4/ EN 50156-1:2004 (as far as applicable) Electrical equipment for furnaces and ancillary equipment – Part 1: Requirements for application design and installation /N5/ EN 54-2:1997+AC:1999+A1:2006 (as far as applicable) Fire detection and fire alarm systems – Part 2: Control and indicating equipment /N6/ NFPA 72:2013 (as far as applicable) National Fire Alarm and Signalling Code Handbook 3. Identification of the test object 3.1. Description of the device under test The AIM Safe System from company Kongsberg Maritime is a safety related controller system consisting of several hardware and software components. The currently approved hardware and software components with their current versions are listed in the annex to the certificate No.: 968/EL 161.05/14. Object of the inspection are the modifications to the AIM Safe System since the last approved AIM release 8.3.3. The modifications are described in detail in the AIM release documents: /D1/ AIM 8.3.3 – 8.3.12, document 367451, revision A, dated 2012-04-04 /D2/ AIM 8.4.0 – 8.4.3, document 367469, revision A, dated 2012-06-05 /D3/ AIM 8.5.0 – 8.5.1, document 370460, revision A, dated 2012-05-04 /D4/ AIM 8.6.0, document 378306, revision A, dated 2013-12-11All considerations concerning uncertainty of the measurements, so far applicable, are stated in the inspector´s documentation, too. In cases where tests have been executed in an external test lab or in the test lab of the manufacturer and where the results of these tests have been used within the here documented approval, this has occurred after a positive assessment of the external test lab and the achieved test results in detail according to the Quality Management procedure QMA 3.310.05. 4.2. Description of changes included in AIM releases 8.3.4 to 8.6.0 The changes included in AIM releases 8.3.4 to 8.3.12 are described in document /D1/. The only change with a potential impact on the safety of the system is the modification of the RBUS driver in order to allow the use of the RTB420 module in 1oo2 applications. As the RTB420 module is not being used for IEC 61508 related applications it must be shown that this modification has been performed in a way which did not change the existing safety functionality of the RBUS driver. Further bug fixes and minor upgrades of the software functionality have been performed. The changes included in AIM releases 8.4.0 to 8.4.3 are described in document /D2/. No safety related change of the system functionality has been introduced. Only bug fixes and minor upgrades of the software functionality have been performed. The changes included in AIM releases 8.5.0 to 8.5.2 are described in document /D3/. A new controller module called RCU502 including hardware and firmware has been developed. Several software components have been modified in relation to the introduction of the new controller module RCU502. Further bug fixes and minor upgrades of the software functionality have been performed. The changes included in AIM release 8.6.0 are described in document /D4/. Mainly further verification activities have been performed for the new controller module RCU502. Further the system has been modified for future use of the new RMP422S I/O module. Additionally availability problems have been solved and bug fixes and minor software upgrades have been implemented. 4.3. Description and evaluation of the changes associated with the introduction of the new controller module RCU502 4.3.1. Description of the new controller module RCU502 and the use of the module in the AIM Safe System The new controller module RCU502 serves as a replacement of the current controller module RCU501. The new controller module is described in the System Requirements Specification RCU502 and in the System Architecture Specification RCU502, see /D5/ documents: 351158 and 351812. The RCU502 module receives safety related input information from external devices like remote I/O modules and/or other controller modules via safety related interfaces. The RCU502 will process this information using the specified application program and will generate safety related output information which will be transmitted to external devices like I/O modules and/or controller modules again via safety related interfaces. The basic structure for the use of the RCU502 module in the AIM Safe System is shown in figure 1Figure 3: RCU502 and AIM software architecture The lowest software layers BSP, HAL and VxWorks form part of the firmware for the module RCU502. The module will be loaded with the common higher software layers AK, PCK, I/O drivers and the application software. Additionally the software for the diagnostic microcontroller and the diagnostic FPGA are also part of the firmware. The architecture of the AIM Safe System complies with the requirements of IEC 61508. 4.3.2. Evaluation of the Systematic Safety Integrity for the module RCU502 The manufacturer has defined a Safety Plan and a Verification and Validation Plan (V&V Plan) for the development of the module RCU502, see /D5/ document: 363044. This document defines the required development activities for the safety related development of the RCU502 module including the required measures for fault avoidance during the different development steps and the required test activities for both the module hardware and module firmware. The defined development activities have been judged to be sufficient by the Test Institute for the development of a module for use in safety applications up to SIL 3. Further the review of the design and test documents generated during the course of the development of the RCU502, see /D5/ various documents, have shown that the requirements for the avoidance of faults during the different development steps have been successfully implemented. It can therefore be concluded that the module reaches the required Systematic Safety Integrity for the use in applications up to SIL

　　Model recommendation:

KONGSBERG RAI-16 X1 E3