Exercises — Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262

Reading the three rulers in the figure above, left (mild) to right (deadly):

• (a) DAL (Design Assurance Level) → DO-178C (airborne). Range A–E. Most dangerous = A (catastrophic / hull loss). E = no effect.
• (b) SIL (Safety Integrity Level) → IEC 61508 (generic). Range 1–4. Most dangerous = 4.
• (c) ASIL (Automotive Safety Integrity Level) → ISO 26262 (automotive). Range A–D plus QM. Most dangerous = D.

The one-line memory anchor: "DO-178C: A is deadly. ISO 26262: D is deadly. IEC: 4 is deadly."

IEC 61508 is the generic parent ("Electrical/Electronic/Programmable Electronic safety-related systems"). ISO 26262 is its automotive child — it takes the same functional-safety logic and specializes it for road vehicles. DO-178C evolved separately in aviation but shares the same "more danger ⇒ more rigor" DNA.

• (i) → DO-178C (structural coverage scales with DAL; certification credit from objectives).
• (ii) → IEC 61508 (quantitative failure-probability targets).
• (iii) → ISO 26262 (split one high ASIL across two independent elements).

The parent note derived, for a 1oo1 channel: $PF{D}_{avg}=\frac{{\lambda }_{DU}{T}_1}{2}$ Here that is the average of a triangle of risk that grows linearly from 0 (right after a test) to ${\lambda }_{DU}{T}_1$ (just before the next), so we take the midpoint — hence the $1/2$. $PF{D}_{avg}=\frac{(2\times 10^{-6})(4380)}{2}=\frac{8.76\times 10^{-3}}{2}=4.38\times 10^{-3}$ Reading this off the IEC ruler (the $PFD$ bands in the figure), it sits in $[10^{-3},10^{-2})$ → SIL 2.

We need $\frac{{\lambda }_{DU}{T}_1}{2}<10^{-3}$, so solve for $T_1$: $T_1<\frac{2\times 10^{-3}}{{\lambda }_{DU}}=\frac{2\times 10^{-3}}{2\times 10^{-6}}=1000\text{hr}.$ So we must proof-test at least every 1000 hours (~42 days). Why this direction of inequality? SIL 3 is more demanding than SIL 2, so we need a smaller $PF{D}_{avg}$, which means testing more often (shorter $T_1$).

Look carefully at how the parent note wrote the bands — each is closed on the low side, open on the high side: $\text{SIL 2}:10^{-3}\le PFD<10^{-2},\text{SIL 3}:10^{-4}\le PFD<10^{-3}.$ The value $10^{-3}$ satisfies $10^{-3}\le PFD$ (SIL 2's lower bound) but fails SIL 3's strict upper bound $PFD<10^{-3}$. So exactly $10^{-3}$ is the bottom of SIL 2 — it is SIL 2, not SIL 3. Why this convention matters: each band boundary is a factor-of-ten line on the IEC ruler; the standard puts the tick inside the weaker band, so you cannot claim the stronger SIL until you are strictly below its top line. Landing exactly on a boundary always rounds you to the less demanding classification — a conservative reading.

MC/DC (Modified Condition/Decision Coverage) typically needs $n+1$ tests, because you need one baseline plus one flip per condition to prove each condition independently drives the outcome: $n+1=4+1=5\text{tests}.$ Plain decision coverage only needs the whole decision to be TRUE once and FALSE once → 2 tests, no matter how many conditions. That is exactly the gap MC/DC closes.

Look at the truth picture below.

An MC/DC set for A && B:

• A is independent: compare T1 (1,1→1) vs T2 (0,1→0). Only A changed (B held at 1), and the outcome flipped. So A alone controls the result. ✔
• B is independent: compare T1 (1,1→1) vs T3 (1,0→0). Only B changed (A held at 1), and the outcome flipped. So B alone controls the result. ✔
• That is 3 tests = $n+1$ with $n=2$.

A decision-coverage-only set: (1,1)→1 and (0,0)→0. The decision is both TRUE and FALSE, so decision coverage passes — but both A and B changed between the two tests, so neither is shown to matter on its own. A bug like A || B would still pass this weaker set on those two points.

Three multipliers stack:

1. Coverage criterion tightens: statement → decision → MC/DC. MC/DC test count grows with the number of conditions per decision ($n+1$), and you must engineer inputs that isolate each condition — labour that scales with code complexity.
2. Independence required: more objectives must be verified by a different person/team, roughly doubling review effort on those items.
3. More objectives: the count of mandatory objectives itself rises with DAL (toward the full 71). Because these multiply rather than add, moving one level up multiplies cost by several factors at once — the classic exponential feel. That is precisely why you assign the level from the hazard first and spend rigor only where lives depend on it (80/20).

$PF{D}_{avg}$ is linear in $T_1$, so halving $T_1$ halves $PF{D}_{avg}$, and therefore doubles $RRF$. Geometric reason: the un-availability grows linearly from 0 to ${\lambda }_{DU}{T}_1$ over the interval — a right triangle. Its average height is half its peak. Cut the base ($T_1$) in half and the peak ${\lambda }_{DU}{T}_1$ also halves, so the whole triangle's average height halves. More frequent testing keeps you closer to the "just tested, good as new" state on average.

ASIL is not fixed like DAL/SIL — it is computed from a hazard analysis of a specific driving scenario via three parameters (see FMEA & Hazard Analysis): $\text{ASIL}=f(S,E,C)$

• S Severity — a steering lock at highway speed likely causes a fatal loss of control → S3.
• E Exposure — highway driving is extremely common → E4.
• C Controllability — a locked wheel at speed is very hard for the driver to recover → C3. The ISO 26262 risk table maps the worst combination (S3, E4, C3) to the top of the scale → ASIL D. This places the scenario at the far-right, deadliest tick of the ASIL ruler in the opening figure. This is the most demanding automotive level, matching the "D is deadly" anchor.

ASIL decomposition (ISO 26262 Part 9, Clause 5) splits one requirement across two elements so that the combination still meets the target, while each element is developed at lower rigor. The standard does not allow arbitrary letter arithmetic; it fixes an integrity budget where each ASIL carries a numeric weight — think of it as points that must add back up: $\text{QM}=0,\text{ASIL A}=1,\text{ASIL B}=2,\text{ASIL C}=3,\text{ASIL D}=4.$ A decomposition of a level-$k$ requirement is valid only if the two child levels' weights sum to $k$. For ASIL D ($=4$) the table therefore permits exactly:

• ASIL C(D) + ASIL A(D) ($3+1=4$),
• ASIL B(D) + ASIL B(D) ($2+2=4$),
• ASIL D(D) + QM(D) ($4+0=4$). The parenthesized (D) is mandatory notation: it records that each element still derives from an original ASIL D goal, so you may never later "forget" the true origin. Combinations like A + A ($1+1=2$) or B + C ($2+3=5$) are not valid decompositions of D — the first under-shoots, the second is not even defined as a decomposition. A clean choice here: develop the primary controller at ASIL B(D) and the independent monitor at ASIL B(D) — the $2+2$ split.

The single non-negotiable condition: the two elements must be sufficiently independent — free of common-cause failure (see Fault Tolerance & Redundancy). If a shared power rail, shared clock, or shared bug can take both down at once, the decomposition is invalid and you are back to needing full ASIL D on the surviving path.

Errors:

1. "DAL 3" does not exist — DO-178C uses letters A–E, not numbers.
2. SIL and DAL are not one-to-one mappable by number. SIL comes from quantitative $PFD/PFH$ targets; DAL comes from a system safety assessment of the worst failure effect. They live on different rulers.
3. The correct move is to re-do the hazard classification in the target domain: assess the airborne failure condition (Catastrophic / Hazardous / Major / Minor / No effect) to assign a DAL directly, rather than transliterating a number. Standards rhyme in philosophy ("more danger ⇒ more rigor") but their level scales are not interchangeable.

• S Severity → S0 (no injuries; a light flicker harms no one).
• Once S0 is reached, the outcome is already QM regardless of E and C — there is no safety goal to protect.
• QM (Quality Management) means: develop it under normal quality processes, with no functional-safety requirement mandated by ISO 26262. You still owe good engineering — reviews, testing, configuration control — but none of the safety-specific objectives (safety goals, ASIL-tagged requirements, decomposition rules) apply, because there is no hazard to guard against.
• Why it is not "ASIL 0": QM sits off the ASIL ruler entirely, to the left of the mildest tick (ASIL A) in the opening figure — it is the label for "this item never entered the safety scale." Writing "ASIL 0" would falsely imply a (tiny) safety objective exists and a place on the scale; QM says instead no ASIL applies at all. The integrity weight from L4.2 makes this precise: QM carries weight 0, confirming it contributes nothing to any safety budget.

Edge insight: the standard degenerates gracefully — at zero severity the whole $f(S,E,C)$ machinery short-circuits straight to QM, and the two branches (has-a-safety-goal vs. QM) never overlap.

In MC/DC we prove a condition independent by finding two tests differing in only that condition with differing outcomes. But when the same variable A appears in multiple places, changing A changes both occurrences at once — you cannot hold the other occurrence fixed. This is strongly coupled conditions, and pure (unique-cause) MC/DC has no valid pair for such a variable. Accepted resolution: DO-178C permits masking MC/DC, where a condition is considered to independently affect the outcome if the Boolean structure masks the other conditions (their values cannot change the result), even if a coupled variable also changes. This is the recognized way to demonstrate MC/DC in the presence of coupling, and it is why "MC/DC = just hold others fixed" is only the first-order story. (Also note A || (A && B) simplifies to A, a good reminder to simplify logic before agonizing over coverage.)

Mathematically the 1oo1 model says $PF{D}_{avg}\to 0$ as $T_1\to 0$ — testing infinitely often would eliminate the dangerous-undetected contribution. But the simplified formula only models undetected faults revealed by proof tests. It omits:

• Imperfect proof-test coverage — real tests find only a fraction of faults, leaving a residual term independent of $T_1$.
• Common-cause and systematic (software) failures — a design bug is present every cycle; testing frequency does not touch it.
• The test itself introduces risk/downtime (wear, human error, taking the function offline). So there is a floor: below some $T_1$, $PF{D}_{avg}$ flattens at the un-modelled residual, and further testing buys nothing. This is why SIL 4 usually demands hardware fault tolerance (redundancy, HFT > 0), not just frequent testing — see Fault Tolerance & Redundancy and Failure Rate & Reliability.

DO-178C most-critical level ::: DAL A (catastrophic) ISO 26262 most-critical level ::: ASIL D IEC 61508 most-critical level ::: SIL 4 1oo1 average PFD formula ::: $PF{D}_{avg}={\lambda }_{DU}{T}_1/2$ MC/DC typical minimum tests for $n$ conditions ::: $n+1$ The three ASIL parameters ::: Severity (S), Exposure (E), Controllability (C) A PFD_avg of exactly $10^{-3}$ classifies as ::: SIL 2 (bands are $10^{-k}\le PFD<10^{-k+1}$, so the boundary rounds into the weaker band) Valid ASIL D decompositions ::: C(D)+A(D), B(D)+B(D), D(D)+QM(D) — weights sum to 4 The single condition for valid ASIL decomposition ::: sufficient independence / no common-cause failure