Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262: Visual walkthrough

This is the engine behind Failure Rate & Reliability and the SIL bands of Functional Safety.

Step 1 — What is a "safety function" and when is it broken?

WHAT. Picture a shutdown valve. It sits still all day. Once in a blue moon a sensor screams "DANGER!" and the valve must slam shut. If it slams shut → good. If it fails to slam shut → disaster. So the device has exactly one job on demand.

WHY. Before any maths, we must define the single event we are measuring: "the device is in a dangerous, undetected broken state at the exact moment it is called." Everything downstream — including $P F D_{a v g}$ — is just the chance of that state.

PICTURE. The timeline is quiet, quiet, quiet — then one red demand arrow. The only thing that matters is: was the box green (working) or dark (broken) when the arrow struck?

Figure — Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262

Step 2 — The failure rate $λ_{D U}$ : our one raw ingredient

WHAT. We introduce the one number the hardware people hand us:

$rate λ_{D U} = \frac{expected number of dangerous-undetected failures}{one hour of operation}$

WHY this symbol and not a probability? A probability is a pure number between 0 and 1. But failures happen over time — the longer you wait, the more likely one appeared. A rate captures "per hour" and lets time do the accumulating. That is exactly the question we face: "how much broken-ness piles up as the clock runs?"

PICTURE. Think of $λ_{D U}$ as raindrops falling at a steady average pace. Small $λ_{D U}$ = rare drizzle; large $λ_{D U}$ = downpour. Each drop is one dangerous-undetected fault landing.

Step 3 — The proof test $T_{1}$ resets the clock

WHAT. Every so often a human runs a proof test: a full check that either finds the hidden fault (and fixes it) or confirms the device is perfect. Call the gap between two proof tests $T_{1}$ (in hours).

WHY. Without a reset the broken-ness would grow forever. The proof test is the eraser — right after it, we assume the device is as-good-as-new (green box). This gives our timeline a repeating sawtooth shape, and lets us study just one interval.

PICTURE. Green "as new" spikes every $T_{1}$ hours; risk climbs between them, then snaps back to zero at each test.

Step 4 — Probability of being broken at time $t$ : the straight line

WHAT. How likely is the device to already be broken by a dangerous-undetected fault, $t$ hours after the last proof test? Call this specific probability $P_{DU} (t)$ — note it counts only the silent dangerous faults driven by $λ_{D U}$ , not every possible failure. The exact answer from reliability theory is:

$P_{DU} (t) = 1 - e^{- λ_{D U} t}$

Here $e^{- λ_{D U} t}$ is the chance it has survived with no dangerous-undetected fault (the exponential-survival curve of Failure Rate & Reliability); one minus that is the chance such a fault has occurred.

WHY approximate it to a line? For a good safety device $λ_{D U} t$ is tiny (far less than 1). For tiny $x$ , the curve $1 - e^{- x}$ hugs the straight line $x$ :

$1 - e^{- x} \approx x when x ≪ 1$

So we may replace the curve with

$P_{DU} (t) \approx λ_{D U} t$

Reading the symbols: $λ_{D U}$ (raindrop rate, Step 2) $\times$ $t$ (hours since reset) $=$ expected number of dangerous-undetected faults so far $\approx$ probability at least one landed. A rate times a time gives a probability — units cancel: $hr^{- 1} \times hr = 1$ .

PICTURE. The true exponential curve and its straight-line stand-in lie almost on top of each other in the region we care about.

Step 5 — The picture is a triangle; the answer is its average height

WHAT. During one interval the risk $P_{DU} (t) = λ_{D U} t$ starts at $0$ (just tested) and climbs to $λ_{D U} T_{1}$ (just before next test). We want the average of this risk across the whole interval — and that average is $P F D_{a v g}$ , because a demand could arrive at any moment inside the interval.

WHY an average, and why the /2? The device isn't always at peak risk — it's usually somewhere in between. The average of a straight line that goes from $0$ up to a peak $H$ is simply $H /2$ — the midpoint. That is the entire origin of the mysterious factor $\frac{1}{2}$ : the area of a triangle is half base times height.

PICTURE. The risk-vs-time graph is a right triangle: base $T_{1}$ , height $λ_{D U} T_{1}$ . The average height (dashed line) sits exactly halfway up.

$P F D_{a v g} = spread over the interval \frac{1}{T _{1}} \int_{0}^{T_{1}} risk P_{DU} (t) λ_{D U} t d t$

Why does $\frac{1}{T _{1}} \int_{0}^{T_{1}} (\dots) d t$ mean "the time-average"? Think of the average of a list of numbers: add them all, then divide by how many there are. Here the "list" is the risk value at every instant $t$ ; the integral $\int_{0}^{T_{1}} λ_{D U} t d t$ adds up the risk across all instants (it is the shaded triangle's area), and dividing by the length $T_{1}$ divides by how many instants there are. Sum ÷ count = average. That is why multiplying the area by $1/ T_{1}$ collapses the whole triangle down to a single average height.

$\int_{0}^{T_{1}} λ_{D U} t d t = λ_{D U} \frac{T _{1}^{2}}{2} \Rightarrow P F D_{a v g} = \frac{1}{T _{1}} \cdot λ_{D U} \frac{T _{1}^{2}}{2} = \frac{λ _{D U} T _{1}}{2}$

One $T_{1}$ cancels, leaving the clean result. The $\frac{T _{1}^{2}}{2}$ is literally $\frac{1}{2} \times base \times height$ written in calculus.

Step 6 — Plug in numbers: watch a SIL appear

WHAT. Use the parent's example: $λ_{D U} = 1 0^{- 6} hr^{- 1}$ , yearly test $T_{1} = 8760 hr$ .

$P F D_{a v g} = \frac{1 0 ^{- 6} \times 8760}{2} = \frac{8.76 \times 1 0 ^{- 3}}{2} = 4.38 \times 1 0^{- 3}$

WHY it matters. $4.38 \times 1 0^{- 3}$ lands inside the band $[1 0^{- 3}, 1 0^{- 2})$ , which IEC 61508 labels SIL 2. The formula didn't just give a probability — it placed the device on the safety ladder.

PICTURE. The computed value dropped onto the SIL band ruler, glowing in the SIL 2 slot.

Step 7 — Edge & degenerate cases (the ones the parent skipped)

WHAT & WHY. A formula is only trustworthy if we know where it breaks. Four scenarios:

PICTURE. All four cases on one risk-vs-time chart: flat line (A), runaway-clipped-at-1 (B), collapsing triangle (C), and the saturation ceiling (D) as a red cap.

The one-picture summary

Everything above compressed: raindrops ( $λ_{D U}$ ) fill a rising line, the proof test ( $T_{1}$ ) resets it into a sawtooth, one tooth is a triangle whose average height is $P F D_{a v g}$ (the boxed answer), and that number drops onto the SIL ladder.

Recall Feynman retelling — say it like a story

Imagine a rescue gadget that just sits there waiting. Every hour there's a tiny, tiny chance it quietly breaks without anyone noticing — that steady chance-per-hour is $λ_{D U}$ , like slow raindrops. The longer it waits, the more likely it's already broken, so the "chance it's broken" grows in a straight line from zero. Every so often a person checks it and fixes it — that's the proof test, spaced $T_{1}$ hours apart, and it snaps the risk back to zero. So the risk graph is a repeating triangle: zero right after a check, tallest right before the next one. Since a rescue call could come at any random moment, we care about the average risk across the triangle — that average is exactly $P F D_{a v g}$ — and the average height of a triangle is just half its peak. Peak $= λ_{D U} T_{1}$ , so average $= λ_{D U} T_{1} /2$ . That's the whole formula. Plug in the yearly-test numbers and you get about $0.0044$ , which lands the device in SIL 2. Test twice as often and the triangle's base halves, so the risk halves. And if you never tested, the triangle would try to grow past 1 — impossible — which just reminds us the straight-line shortcut only works while the risk stays small.

Recall Check yourself

What exactly does $P F D_{a v g}$ measure? ::: The average probability that a safety device is already broken (by a dangerous-undetected fault) at the moment a random demand arrives — a pure number between 0 and 1. Why is there a factor of one-half in $P F D_{a v g}$ ? ::: Because the risk climbs linearly from 0 to a peak, and the average of a straight ramp is its midpoint — the triangle's area is $\frac{1}{2} base \times height$ . What does $λ_{D U}$ mean and its units? ::: The rate of dangerous-undetected failures, in $hr^{- 1}$ ; it's the "raindrop" pace of hidden faults. Why does $\frac{1}{T _{1}} \int_{0}^{T_{1}} (\dots) d t$ give a time-average? ::: The integral sums the risk over every instant (the area), and dividing by the interval length $T_{1}$ divides by "how many" instants — sum ÷ count = average. Where does the formula stop being valid? ::: When $λ_{D U} T_{1}$ is no longer tiny — the true probability saturates at 1 while the line keeps rising, so the linear formula only holds in the small-risk region.

See also: Code Coverage Metrics · Fault Tolerance & Redundancy · FMEA & Hazard Analysis · V-Model Software Lifecycle · Real-Time Operating Systems.