This page assumes nothing. Before you read the parent note, you must be able to read every symbol it throws at you without pausing. Let's build them one at a time, each on top of the last.
Before any letter or number, hold this image in your head.
Figure s01 — A see-saw: on the left, a heavy pan labelled HAZARD (possible harm) tips down; on the right, a pan labelled RIGOR (effort to prove safe) rises. An arrow marks the pivot with "must balance." It shows the single rule of the whole topic — more possible harm demands more engineering rigor.
Every symbol below is a tool for measuring one side of that see-saw — either how big is the danger or how thoroughly did we check.
The picture: a fault is a landmine buried in the field. An error is stepping on it. A failure is the explosion everyone sees.
Why the topic needs this: every standard is obsessed with dangerous failures — the explosions that reach a person and can cause harm. Faults that never become failures don't hurt anyone. See Fault Tolerance & Redundancy for how systems catch errors before they become failures.
The picture: each minus-one in the exponent shifts the decimal point one step left, making the number ten times smaller.
Figure s02 — A horizontal number line of dots labelled 100,10−1,…,10−6 with their decimal values (1, 0.1, ..., 0.000001) underneath, and an arrow noting "each step: 10x smaller (safer)." It defines how to read the tiny probabilities used in the SIL bands.
Why the topic needs this: failure probabilities are naturally tiny (1 in a million per hour). Writing them as 0.000001 is error-prone; 10−6 is clean. Every safety band is a range of these.
The picture: imagine tally marks appearing on a wall, one each time something fails. λ is how fast the marks appear. A drippy tap dripping once an hour has "drip rate" λ=1/hr.
Why the subscript λDU? The parent tags it: Dangerous, Undetected. Not every fault is dangerous, and some dangerous ones get caught by diagnostics. λDU counts only the ones that are both dangerous and silent — the truly scary ones. See Failure Rate & Reliability.
The parent uses 1−e−λt≈λt without explaining it. First we must earn the letter e itself.
Why the exponential and not, say, a straight line? A straight line would eventually hit zero and go negative — impossible for a fraction. Exponential decay glides toward zero and never crosses it, and it's the only curve where the shrink rate is proportional to how much is left. That "proportional to what remains" is exactly what constant-rate, memoryless failure means.
Figure s03 — Two curves against time: the lavender "still working" survival curve e−λt falling from 1, and the coral "already failed" curve 1−e−λt rising from 0, with a dashed straight line λt hugging the failed curve near the origin (shaded butter region). It shows why the exact risk can be replaced by the straight line λt only for small t.
The picture: zoom into the very start of the falling curve — it looks straight. That straight bit is λt. This is why the parent can replace the scary exponential with the simple product λDUt — but only because λDUT1 is far below 1 in real safety systems.
The parent computes PFDavg=T11∫0T1λDUtdt. Three things are new: PFD, ∫, and T1.
The picture: the failure probability grows from 0 (just tested, perfect) up to about λDUT1 (just before the next test) along a nearly straight ramp. The integral is the area under that ramp. Dividing by T1 turns "total area" into "average height," which is PFDavg.
Figure s04 — A coral ramp rising from 0 at "just tested" to λDUT1 at "just before next test," with the triangular area under it shaded, and a dashed mint line at half-height marking the average λDUT1/2. It shows geometrically why averaging the straight risk ramp gives the factor of one-half.
Why the integral: it's the honest way to turn "risk that keeps growing between tests" into a single average number (PFDavg) you can compare to a safety band. (The approximation λDUt makes that integral a triangle instead of a curve — fine because λDUT1≪1.)
The picture: three staircases. On the DAL staircase, the top step is labelled A. On the SIL staircase, the top is 4. On the ASIL staircase, the top is D. Same height (max rigor) — different label at the top.
Why the topic needs levels at all: rigor is expensive and grows roughly exponentially with strictness. Levels are how you spend effort where lives depend on it — the see-saw made into a dial. See Functional Safety and FMEA & Hazard Analysis for how the hazard side is measured.
The picture: think of a road map of the program. Statement coverage = "did we drive every road?" Decision coverage = "did we take every fork both ways?" MC/DC = "did we prove each individual signpost actually matters to where we end up?"
Why the topic needs three: stricter coverage catches subtler bugs but costs more tests — so the parent ties the deadliest level (DAL A) to the strictest coverage (MC/DC). Full detail lives in Code Coverage Metrics.
Cover the right side; can you answer before revealing?
What does 10−4 equal as a decimal?
0.0001 — one in ten thousand.
What is the difference between a hazard and harm?
A hazard is the possibility of danger; harm is the actual injury or loss that results.
What is the difference between a fault and a failure?
A fault is a hidden flaw; a failure is the flaw actually causing wrong outside behaviour (the visible explosion).
What does λ measure, and in what units?
A failure rate — how many failures per unit time, usually per hour (1/hr).
What does the symbol t stand for here?
A duration of elapsed time, in hours.
Why does λDU carry the letters D and U?
Dangerous and Undetected — the failures that both matter and stay silent.
What does the survival function P(t) represent?
The probability the component is still working at time t after its last test; P(0)=1, falling toward 0.
What number is e, and what makes it special?
e≈2.71828; e−λt is the one curve whose rate of change equals −λ times itself (dP/dt=−λP).
What modeling assumption lets us use e−λt for survival?
A constant-rate, memoryless (Poisson) failure process — chance of failing next moment doesn't depend on age.
Why is 1−e−λt≈λt for small t, and when is it valid?
Near the origin the rising "already failed" curve leaves with slope λ, so it hugs the straight line λt; the approximation is valid only while λt≪1 (very few failures so far).
What does PFD mean, and what is PFDavg?
Probability of Failure on Demand — the chance the safety function is already broken when needed; PFDavg is that averaged over the test interval.
What does ∫0T1 compute geometrically here?
The area under the risk-vs-time ramp between a test and the next.
Where does the 21 in PFDavg=λDUT1/2 come from?
The average height of a straight ramp is its midpoint — half the peak.
In DO-178C, is DAL A the safest or the most critical?
The most critical (worst-case failure) — it demands the most rigor, including MC/DC.
In ISO 26262, which letter is most demanding?
D (with QM being "no safety requirement").
What extra thing does MC/DC require beyond decision coverage?
Each individual condition must be shown to independently flip the outcome.
