Question bank — Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262

False — they are opposite. DAL A is the deadliest aviation level (hull loss), while ASIL A is the least safety-critical automotive level; ASIL D is the deadly one.

False — it is the reverse. SIL 4 demands $PF{D}_{avg}$ in $[10^{-5},10^{-4})$, which is a smaller (more stringent) failure probability than SIL 1's $[10^{-2},10^{-1})$.

False — it is a process standard. It only requires auditable evidence that a disciplined lifecycle (objectives, independence, coverage) was followed; residual bugs can still exist.

True — ISO 26262 is the automotive adaptation of the generic parent IEC 61508, reusing the "more danger ⇒ more rigor" logic but replacing quantitative SIL with the $S,E,C$-derived ASIL.

True — to show each condition independently flips the outcome you must exercise the whole decision both TRUE and FALSE, so decision coverage is a subset of what MC/DC forces.

False — QM means no safety-specific mandate, but normal quality-management engineering practices still apply; it is "no safety integrity requirement," not "no engineering."

True — since $PF{D}_{avg}={\lambda }_{DU}{T}_1/2$ is linear in $T_1$, cutting the interval in half cuts the average failure probability in half.

False — even at DAL A only a subset of objectives require independence; the number of objectives and the number needing independence both grow with criticality, but not all demand it.

The error is the count and the criterion. MC/DC needs each condition to independently flip the outcome while others are held fixed; for two conditions that is $n+1=3$ tests, not 4, and mere "each value seen" is condition coverage, not MC/DC.

The error is the band edge. SIL 3 is $10^{-4}\le PFD<10^{-3}$; a value of $2\times 10^{-3}$ is above $10^{-3}$ and therefore lands in SIL 2, not SIL 3.

The error is the mapping. MC/DC is the DAL A coverage criterion; DAL B needs decision coverage and DAL C only needs statement coverage — the cheapest of the three.

The error is confusing derivation methods. ASIL is computed per hazardous scenario from Severity, Exposure, and Controllability; it is not a fixed attribute you look up for a part.

The error ignores ASIL decomposition. A D requirement may be split across two sufficiently independent elements (e.g. B(D)+B(D) or A+C), each developed at lower rigor, provided no common-cause failure links them.

The error is treating it as arbitrary. The $1/2$ comes from averaging the linearly-growing failure probability over the test interval — the mean of a line rising from 0 to ${\lambda }_{DU}{T}_1$ is its midpoint.

The error is comparing rigor across domains. The standards use different scales and authorities for different consequences; "mass-produced" changes the certification model (self-cert + audit vs per-aircraft), not a universal strictness ranking.

Because verification cost grows roughly exponentially with rigor, so you spend the expensive effort only where failure consequences are severe — an 80/20 of safety, echoed in Functional Safety.

Decision coverage can pass by toggling the whole outcome while some condition's individual effect is never isolated; MC/DC forces each condition to demonstrably control the result, exposing faults hidden inside compound Booleans — see Code Coverage Metrics.

A rarely-acting safety function (like an emergency shutdown) is characterised by whether it works when finally called, so probability-per-demand fits; a continuously-relied-on function is better measured by dangerous failures per hour of operation.

It was written domain-independently for any electrical/programmable safety system, and automotive engineers specialised it into ISO 26262 rather than reinventing the underlying functional-safety philosophy.

Independence removes the blind spots of self-review — the person who wrote a bug tends to re-test with the same wrong mental model, so a separate reviewer breaks common-cause reasoning errors, a redundancy idea from Fault Tolerance & Redundancy.

Risk is not just how bad an outcome is; a rare situation ($E$) or one the driver can easily control ($C$) lowers real-world danger even when severity ($S$) is high — combining all three, à la FMEA & Hazard Analysis, estimates true exposure to harm.

QM — if no injury can occur, there is no safety hazard to integrate against, so no safety integrity level is assigned no matter how frequent or uncontrollable the situation.

It approaches $0$, since $PF{D}_{avg}={\lambda }_{DU}{T}_1/2\to 0$; constant re-testing means a dangerous undetected fault is essentially never latent — an idealised limit, unreachable in practice.

When ${\lambda }_{DU}t$ is no longer small (long intervals or high failure rates), the true $1-e^{-\lambda t}$ curves below the straight line, so the simplified formula overestimates $PFD$ and the linear model must be replaced — linked to Failure Rate & Reliability.

None mandated for safety — DAL E means "no effect on safety" if it fails, so no structural coverage objective applies; it is engineered to normal quality expectations only.

At $PFD=10^{-4}$ (the SIL 3/SIL 4 edge) the RRF is exactly $10^4=10,000$; values needing more reduction than this cross into SIL 4 territory.

No — a shared power supply is a common-cause failure that can down both elements at once, violating the independence precondition, so the split back to lower rigor is not credible.