Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262: Exercises

5.5.18 · D4 · Coding › Embedded Systems & Real-Time Software › Safety-critical standards — DO-178C (airborne software), IEC

Shuru karne se pehle, ek shared picture. Har safety standard ek ruler hai jo danger ko measure karta hai, phir tumhe ek rulebook deta hai jiska moota pan danger ke barabar hota hai. Hum is figure par har level par wapas aayenge: L1 rulers (level names) padhta hai, L2 IEC ruler se measure karta hai ( $P F D$ bands), L4 ek car scenario ko ASIL ruler par rakhta hai, aur L5 poochta hai ki tick marks par aur ruler ke edge ke baad kya hota hai.

Figure — Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262

Level 1 — Recognition

Goal: kya tum bina kuch compute kiye pieces ka naam le sakte ho?

L1.1 — Level name ko uske standard se match karo

Problem. Neeche diye gaye har level name ke liye, batao ki woh kaun se standard se belong karta hai aur kya "sabse dangerous" end pehla symbol hai ya aakhri: (a) DAL, (b) SIL, (c) ASIL.

Recall Solution

Upar figure mein teeno rulers ko padhte hue, left (mild) se right (deadly) tak:

(a) DAL (Design Assurance Level) → DO-178C (airborne). Range A–E. Sabse dangerous = A (catastrophic / hull loss). E = no effect.
(b) SIL (Safety Integrity Level) → IEC 61508 (generic). Range 1–4. Sabse dangerous = 4.
(c) ASIL (Automotive Safety Integrity Level) → ISO 26262 (automotive). Range A–D plus QM. Sabse dangerous = D.

Ek-line memory anchor: "DO-178C: A deadly hai. ISO 26262: D deadly hai. IEC: 4 deadly hai."

L1.2 — Kaun sa standard ancestor hai?

Problem. Teeno mein se kaun sa generic parent hai jisse ek doosra adapt kiya gaya, aur child ka naam batao?

Recall Solution

IEC 61508 generic parent hai ("Electrical/Electronic/Programmable Electronic safety-related systems"). ISO 26262 uska automotive child hai — woh same functional-safety logic leta hai aur usse road vehicles ke liye specialize karta hai. DO-178C aviation mein alag se evolve hua lekin same "zyada danger ⇒ zyada rigor" DNA share karta hai.

L1.3 — Signature concept ka naam batao

Problem. Har signature concept ko uske standard se connect karo: (i) MC/DC coverage + 71 objectives, (ii) $P F D_{a v g}$ aur risk-reduction factor, (iii) ASIL decomposition + item definition.

Recall Solution

(i) → DO-178C (structural coverage DAL ke saath scale hoti hai; objectives se certification credit milta hai).
(ii) → IEC 61508 (quantitative failure-probability targets).
(iii) → ISO 26262 (ek high ASIL ko do independent elements mein split karo).

Level 2 — Application

Goal: parent note ki derive ki gayi formulas mein numbers daalo.

L2.1 — $P F D_{a v g}$ compute karo aur SIL padho

Problem. Ek low-demand safety function (ek 1-out-of-1 shutdown valve) ka dangerous-undetected failure rate $λ_{D U} = 2 \times 1 0^{- 6} / hr$ hai aur har 6 months mein proof-test hota hai ( $T_{1} = 4380 hr$ ). $P F D_{a v g}$ compute karo aur SIL batao.

Recall Solution

Parent note ne 1oo1 channel ke liye derive kiya tha: $P F D_{a v g} = \frac{λ _{D U} T _{1}}{2}$ Yahan yeh risk ke ek triangle ka average hai jo linearly 0 se badhta hai (test ke baad) $λ_{D U} T_{1}$ tak (agla test aane se pehle), isliye hum midpoint lete hain — isliye $1/2$ . $P F D_{a v g} = \frac{( 2 \times 1 0 ^{- 6} ) ( 4380 )}{2} = \frac{8.76 \times 1 0 ^{- 3}}{2} = 4.38 \times 1 0^{- 3}$ Isse IEC ruler ( $P F D$ bands figure mein) par padhne par, yeh $[1 0^{- 3}, 1 0^{- 2})$ mein baith ta hai → SIL 2.

L2.2 — Kaun sa test interval SIL 3 dilata hai?

Problem. Same valve, $λ_{D U} = 2 \times 1 0^{- 6} / hr$ . Sabse lamba proof-test interval $T_{1}$ kya hai jo phir bhi SIL 3 achieve karta hai, yaani $P F D_{a v g} < 1 0^{- 3}$ rakhta hai?

Recall Solution

Humein chahiye $\frac{λ _{D U} T _{1}}{2} < 1 0^{- 3}$ , toh $T_{1}$ ke liye solve karo: $T_{1} < \frac{2 \times 1 0 ^{- 3}}{λ _{D U}} = \frac{2 \times 1 0 ^{- 3}}{2 \times 1 0 ^{- 6}} = 1000 hr .$ Toh hume kam se kam har 1000 hours (~42 days) mein proof-test karna hoga. Yeh inequality is direction mein kyun hai? SIL 3, SIL 2 se zyada demanding hai, isliye hume chota $P F D_{a v g}$ chahiye, matlab testing zyada baar (shorter $T_{1}$ ).

L2.3 — Boundary par exactly kaun sa SIL band?

Problem. Maano ek calculation $P F D_{a v g} = 1.0 \times 1 0^{- 3}$ exactly deti hai. Kya yeh SIL 2 hai ya SIL 3? Band convention batao aur classify karo.

Recall Solution

Dhyan se dekho ki parent note ne bands kaise likhe — har ek low side par closed, high side par open hai: $SIL 2 : 1 0^{- 3} \leq P F D < 1 0^{- 2}, SIL 3 : 1 0^{- 4} \leq P F D < 1 0^{- 3} .$ Value $1 0^{- 3}$ satisfies $1 0^{- 3} \leq P F D$ (SIL 2 ka lower bound) lekin fail karta hai SIL 3 ka strict upper bound $P F D < 1 0^{- 3}$ . Toh exactly $1 0^{- 3}$ SIL 2 ka bottom hai — yeh SIL 2 hai, SIL 3 nahi. Yeh convention kyun matter karta hai: har band boundary IEC ruler par ek factor-of-ten line hai; standard tick ko weaker band ke andar rakhta hai, isliye tum stronger SIL claim nahi kar sakte jab tak tum uski top line ke strictly neeche na ho. Kisi boundary par exactly land karna hamesha tumhe less demanding classification mein le jaata hai — ek conservative reading.

L2.4 — Minimum MC/DC test count

Problem. Ek Boolean decision mein $n = 4$ conditions hain, jaise if (A && B && C && D). MC/DC achieve karne ke liye typical minimum number of tests kya hai, aur plain decision coverage ke liye kitne?

Recall Solution

MC/DC (Modified Condition/Decision Coverage) ko typically $n + 1$ tests chahiye, kyunki tumhe ek baseline plus har condition ke liye ek flip chahiye taaki prove ho sake ki har condition independently outcome drive karta hai: $n + 1 = 4 + 1 = 5 tests .$ Plain decision coverage ko sirf whole decision ke ek baar TRUE aur ek baar FALSE hone ki zarurat hai → 2 tests, chahe kitni bhi conditions hon. Yahi woh gap hai jo MC/DC close karta hai.

Level 3 — Analysis

Goal: sirf compute nahi, WHY explain karo.

L3.1 — `A && B` ke liye MC/DC test set banao

Problem. Decision A && B ke liye, ek concrete MC/DC-satisfying test set list karo aur prove karo, test by test, ki har condition independently outcome ko affect karta hai. Phir ek 2-test set dikhao jo decision coverage satisfy kare lekin not MC/DC.

Recall Solution

Neeche truth picture dekho.

A && B ke liye ek MC/DC set:

Test	A	B	`A&&B`
T1	1	1	1
T2	0	1	0
T3	1	0	0

A independent hai: compare T1 (1,1→1) vs T2 (0,1→0). Sirf A badla (B 1 par hold raha), aur outcome flip ho gaya. Toh A akela result control karta hai. ✔
B independent hai: compare T1 (1,1→1) vs T3 (1,0→0). Sirf B badla (A 1 par hold raha), aur outcome flip ho gaya. Toh B akela result control karta hai. ✔
Yeh 3 tests = $n + 1$ hai $n = 2$ ke saath.

Ek decision-coverage-only set: (1,1)→1 aur (0,0)→0. Decision TRUE bhi hua aur FALSE bhi, toh decision coverage pass hai — lekin dono A aur B dono tests ke beech badle, toh koi bhi apne aap on its own matter karta dikhaya nahi gaya. A || B jaisa ek bug in do points par is weaker set ko phir bhi pass kar deta.

L3.2 — Rigor cost roughly exponentially kyun badhti hai?

Problem. Parent note claim karta hai ki verification cost rigor ke saath "roughly exponentially" badhti hai, jo levels ko motivate karta hai. Analysis do: DAL C → B → A chadhne par specifically kya multiply hota hai?

Recall Solution

Teen multipliers stack hote hain:

Coverage criterion tight hoti hai: statement → decision → MC/DC. MC/DC test count har decision mein conditions ki sankhya ke saath badhta hai ( $n + 1$ ), aur tumhe aisi inputs engineer karni padti hain jo har condition ko isolate karti hain — ek aise labour jo code complexity ke saath scale hoti hai.
Independence required hai: zyada objectives ek alag person/team dwara verify kiye jaane chahiye, roughly un items par review effort double ho jaata hai.
Zyada objectives: mandatory objectives ki count khud DAL ke saath badhti hai (full 71 ki taraf). Kyunki ye add hone ke bajaye multiply hote hain, ek level upar jaana ek saath kai factors se cost multiply kar deta hai — classic exponential feel. Isi liye tum level pehle hazard se assign karte ho aur rigor wahan kharch karte ho jahan lives depend karti hain (80/20).

L3.3 — $P F D_{a v g}$ ki sensitivity

Problem. $P F D_{a v g} = λ_{D U} T_{1} /2$ mein, agar tum proof-test interval $T_{1}$ ko half karo, toh $P F D_{a v g}$ aur risk-reduction factor $R R F = 1/ P F D_{a v g}$ ka kya hoga? Geometrically explain karo.

Recall Solution

$P F D_{a v g}$ , $T_{1}$ mein linear hai, isliye $T_{1}$ half karne se $P F D_{a v g}$ half ho jaata hai, aur isliye $R R F$ double ho jaata hai. Geometric reason: un-availability interval par 0 se $λ_{D U} T_{1}$ tak linearly badhti hai — ek right triangle. Uski average height uski peak ki half hoti hai. Base ( $T_{1}$ ) ko half karo toh peak $λ_{D U} T_{1}$ bhi half ho jaata hai, isliye poore triangle ki average height half ho jaati hai. Zyada frequent testing tumhe average par "abhi test hua, good as new" state ke paas rakhti hai.

Level 4 — Synthesis

Goal: multiple ideas ko ek full derivation mein combine karo.

L4.1 — Full ASIL determination

Problem. Scenario: ek highway-speed steering system wheel ko unexpectedly lock kar sakta hai. Severity, Exposure, Controllability assess karo aur ASIL derive karo. Use karo: S3 = life-threatening/fatal; E4 = high probability of the situation; C3 = difficult/uncontrollable. ASIL batao.

Recall Solution

ASIL DAL/SIL ki tarah fixed nahi hoti — yeh teen parameters ke zariye ek specific driving scenario ke hazard analysis se computed hoti hai (dekho FMEA & Hazard Analysis): $ASIL = f (S, E, C)$

S Severity — highway speed par steering lock hone se likely fatal loss of control hoga → S3.
E Exposure — highway driving bahut common hai → E4.
C Controllability — speed par locked wheel ko recover karna driver ke liye bahut mushkil hai → C3. ISO 26262 risk table worst combination (S3, E4, C3) ko scale ke top par map karta hai → ASIL D. Yeh scenario ko opening figure mein ASIL ruler ke far-right, deadliest tick par rakhta hai. Yeh sabse demanding automotive level hai, "D is deadly" anchor se match karta hai.

L4.2 — Cost cut karne ke liye ASIL decomposition

Problem. ASIL D steering requirement ko monolithically build karna expensive hai. Tumhare paas do independent subsystems hain (ek primary controller aur ek independent monitor jo torque cut kar sakta hai). Ek valid ASIL decomposition propose karo aur resulting per-element levels batao. Ek single condition kya honi chahiye jo isse legitimate banaye?

Recall Solution

ASIL decomposition (ISO 26262 Part 9, Clause 5) ek requirement ko do elements mein split karta hai taaki combination phir bhi target meet kare, jabki har element lower rigor par develop ho. Standard arbitrary letter arithmetic allow nahi karta; yeh ek integrity budget fix karta hai jahan har ASIL ek numeric weight carry karta hai — socho jaisa points jo wapas add up hone chahiye: $QM = 0, ASIL A = 1, ASIL B = 2, ASIL C = 3, ASIL D = 4.$ Ek level- $k$ requirement ka decomposition tab valid hai jab do child levels ke weights $k$ tak sum hon. ASIL D ( $= 4$ ) ke liye table isliye exactly yeh allow karta hai:

ASIL C(D) + ASIL A(D) ( $3 + 1 = 4$ ),
ASIL B(D) + ASIL B(D) ( $2 + 2 = 4$ ),
ASIL D(D) + QM(D) ( $4 + 0 = 4$ ). Parenthesized (D) mandatory notation hai: yeh record karta hai ki har element abhi bhi ek original ASIL D goal se derive hota hai, isliye tum baad mein kabhi true origin "bhool" nahi sakte. A + A ( $1 + 1 = 2$ ) ya B + C ( $2 + 3 = 5$ ) jaisi combinations D ki valid decompositions nahi hain — pehli under-shoot karti hai, doosri ek decomposition ke roop mein define hi nahi hai. Yahan ek clean choice: primary controller ko ASIL B(D) par aur independent monitor ko ASIL B(D) par develop karo — $2 + 2$ split.

Single non-negotiable condition: do elements sufficiently independent — common-cause failure se free hone chahiye (dekho Fault Tolerance & Redundancy). Agar ek shared power rail, shared clock, ya shared bug dono ko ek saath gira sakta hai, toh decomposition invalid hai aur tum wapas surviving path par full ASIL D ki zarurat par aa jaate ho.

L4.3 — Cross-standard translation

Problem. Ek engineer kehta hai "yeh function SIL 3 hai, toh aviation mein obviously DAL 3 hai." Us sentence mein har error diagnose karo aur sahi cross-standard reasoning do.

Recall Solution

Errors:

"DAL 3" exist nahi karta — DO-178C letters A–E use karta hai, numbers nahi.
SIL aur DAL number ke hisaab se one-to-one mappable nahi hain. SIL quantitative $P F D / P F H$ targets se aata hai; DAL worst failure effect ke system safety assessment se aata hai. Yeh alag rulers par live karte hain.
Sahi move hai target domain mein hazard classification re-do karna: airborne failure condition assess karo (Catastrophic / Hazardous / Major / Minor / No effect) taaki directly DAL assign ho, number transliterate karne ke bajaye. Standards philosophy mein rhyme karte hain ("zyada danger ⇒ zyada rigor") lekin unke level scales interchangeable nahi hain.

Level 5 — Mastery

Goal: edges par reason karo, jahan naive rule toot jaata hai.

L5.1 — Degenerate / QM boundary

Problem. Ek flickering interior dome light assess ki jaati hai. Failure ki severity essentially "annoyance" hai. S/E/C reasoning walk karo aur explain karo ki QM ka matlab kya hai aur yeh "ASIL 0" kyun nahi hai.

Recall Solution

S Severity → S0 (koi injuries nahi; light flicker kisi ko harm nahi karta).
S0 reach hote hi, outcome already QM ho jaata hai regardless of E aur C — protect karne ke liye koi safety goal nahi hai.
QM (Quality Management) matlab: isse normal quality processes ke under develop karo, ISO 26262 dwara koi functional-safety requirement mandated nahi hai. Tum phir bhi achhi engineering owe karte ho — reviews, testing, configuration control — lekin koi safety-specific objectives nahi (safety goals, ASIL-tagged requirements, decomposition rules) apply hote, kyunki guard karne ke liye koi hazard nahi hai.
Yeh "ASIL 0" kyun nahi hai: QM ASIL ruler se bilkul bahar baith ta hai, mildest tick (ASIL A) ke left mein opening figure mein — yeh label hai "yeh item kabhi safety scale mein enter hi nahi hua." "ASIL 0" likhna falsely imply karta ki ek (tiny) safety objective exist karta hai aur scale par ek jagah hai; QM iske bajaye kehta hai koi ASIL apply hi nahi hota. L4.2 se integrity weight isse precise banata hai: QM weight 0 carry karta hai, confirm karta hai ki yeh kisi safety budget mein kuch contribute nahi karta.

Edge insight: standard gracefully degenerate hota hai — zero severity par poora $f (S, E, C)$ machinery seedha QM par short-circuit ho jaata hai, aur do branches (has-a-safety-goal vs. QM) kabhi overlap nahi karte.

L5.2 — Coupled condition ke saath MC/DC (subtle case)

Problem. Consider karo if (A || (A && B)). Yahan A do baar appear karta hai, isliye A aur term A && B coupled hain — tum hamesha A ko vary nahi kar sakte doosre operand ko fixed rakhte hue. Explain karo kyun naive "baaki sab constant rakho" MC/DC yahan impossible ho sakta hai, aur accepted resolution ka naam batao.

Recall Solution

MC/DC mein hum ek condition ko independent prove karte hain sirf us condition mein alag do tests find karke jinke outcomes alag hain. Lekin jab same variable A kai jagah appear karta hai, A ko change karna dono occurrences ko ek saath change karta hai — tum doosre occurrence ko fixed nahi rakh sakte. Yeh strongly coupled conditions hai, aur pure (unique-cause) MC/DC ke paas aise variable ke liye koi valid pair nahi hoti. Accepted resolution: DO-178C masking MC/DC allow karta hai, jahan ek condition ko independently outcome affect karna mana jaata hai agar Boolean structure doosri conditions ko mask karta ho (unki values result nahi badal sakti), chahe ek coupled variable bhi badle. Yeh MC/DC demonstrate karne ka recognized tarika hai coupling ki presence mein, aur isi liye "MC/DC = bas doosron ko fixed rakho" sirf first-order story hai. (Yeh bhi note karo ki A || (A && B) simplify ho jaata hai A mein, ek achha reminder ki coverage ke baare mein sochne se pehle logic simplify karo.)

L5.3 — Zyada testing $P F D$ ki help kab karna band kar deta hai?

Problem. $P F D_{a v g} = λ_{D U} T_{1} /2$ mein, jaise tum $T_{1} \to 0$ push karte ho (constantly test karo), $P F D_{a v g} \to 0$ . Kya testing zyada karke unlimited integrity really free hai? Woh real-world floor identify karo jo simplified formula chhupa leti hai.

Recall Solution

Mathematically 1oo1 model kehta hai $P F D_{a v g} \to 0$ jaise $T_{1} \to 0$ — infinitely baar testing dangerous-undetected contribution eliminate kar deti. Lekin simplified formula sirf un undetected faults ko model karta hai jo proof tests se reveal hote hain. Yeh omit karta hai:

Imperfect proof-test coverage — real tests sirf ek fraction faults find karte hain, ek residual term chhod kar jo $T_{1}$ se independent hai.
Common-cause aur systematic (software) failures — ek design bug har cycle mein present hota hai; testing frequency usse touch nahi karti.
Test khud risk/downtime introduce karta hai (wear, human error, function ko offline le jaana). Isliye ek floor hoti hai: kuch $T_{1}$ se neeche, $P F D_{a v g}$ un-modelled residual par flatten ho jaata hai, aur aage testing kuch nahi kharidti. Isi liye SIL 4 ko usually hardware fault tolerance (redundancy, HFT > 0) chahiye hota hai, sirf frequent testing nahi — dekho Fault Tolerance & Redundancy aur Failure Rate & Reliability.

Recall Quick self-check reveals

DO-178C most-critical level ::: DAL A (catastrophic) ISO 26262 most-critical level ::: ASIL D IEC 61508 most-critical level ::: SIL 4 1oo1 average PFD formula ::: $P F D_{a v g} = λ_{D U} T_{1} /2$ MC/DC typical minimum tests for $n$ conditions ::: $n + 1$ The three ASIL parameters ::: Severity (S), Exposure (E), Controllability (C) A PFD_avg of exactly $1 0^{- 3}$ classifies as ::: SIL 2 (bands are $1 0^{- k} \leq P F D < 1 0^{- k + 1}$ , so the boundary rounds into the weaker band) Valid ASIL D decompositions ::: C(D)+A(D), B(D)+B(D), D(D)+QM(D) — weights sum to 4 The single condition for valid ASIL decomposition ::: sufficient independence / no common-cause failure

Related: Functional Safety · Code Coverage Metrics · Failure Rate & Reliability · Fault Tolerance & Redundancy · V-Model Software Lifecycle · FMEA & Hazard Analysis · Real-Time Operating Systems