Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262: Visual walkthrough

5.5.18 · D2 · Coding › Embedded Systems & Real-Time Software › Safety-critical standards — DO-178C (airborne software), IEC

Yeh Failure Rate & Reliability ke engine aur Functional Safety ke SIL bands ke peeche kaam karta hai.

Step 1 — "Safety function" kya hoti hai aur kab broken hoti hai?

KYA. Ek shutdown valve ki picture banao. Woh saara din bas baithe rehta hai. Kabhi kabhi koi sensor chillata hai "KHATRAA!" aur valve ko band ho jaana chahiye. Agar band ho gaya → achha. Agar band nahi hua → takleef. Toh device ka exactly ek kaam demand pe hota hai.

KYUN. Koi bhi maths se pehle, hum uss ek event ko define karna chahte hain jo hum measure kar rahe hain: "device ek dangerous, undetected broken state mein hai bilkul us waqt jab use call kiya jaata hai." Aage ka sab kuch — including $P F D_{a v g}$ — sirf uss state ki chance hai.

PICTURE. Timeline hai shant, shant, shant — phir ek red demand arrow. Sirf ek cheez mayne rakhti hai: kya box green tha (kaam kar raha tha) ya dark (broken) jab arrow aaya?

Figure — Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262

Step 2 — Failure rate $λ_{D U}$ : hamaari ek raw ingredient

KYA. Hum woh ek number introduce karte hain jo hardware wale humein dete hain:

$rate λ_{D U} = \frac{expected number of dangerous-undetected failures}{operation ka ek ghanta}$

Yeh symbol kyun, probability kyun nahi? Probability ek pure number hoti hai 0 aur 1 ke beech. Lekin failures time ke saath hoti hain — jitna zyada intezaar karo, utni zyada chance ki ek aa gayi. Ek rate "per hour" capture karta hai aur time ko accumulate karne deta hai. Yahi toh sawaal hai hmare saamne: "clock chalne ke saath kitna broken-ness jamta jaata hai?"

PICTURE. $λ_{D U}$ ko socho jaise raindrops ek steady average pace par gir rahe hain. Chhota $λ_{D U}$ = rare drizzle; bada $λ_{D U}$ = downpour. Har drop ek dangerous-undetected fault hai jo land kar raha hai.

Step 3 — Proof test $T_{1}$ clock reset karta hai

KYA. Thode thode time baad ek insaan ek proof test karta hai: ek poora check jo ya toh hidden fault dhundh leta hai (aur fix kar deta hai) ya confirm karta hai ki device perfect hai. Do proof tests ke beech ke gap ko $T_{1}$ (ghanton mein) kehte hain.

KYUN. Reset ke bina broken-ness hamesha ke liye badhti rahegi. Proof test eraser hai — uske baad, hum maante hain ki device as-good-as-new hai (green box). Isse hamare timeline ko ek repeating sawtooth shape milti hai, aur hum sirf ek interval study kar sakte hain.

PICTURE. Green "as new" spikes har $T_{1}$ ghanton mein; risk beech mein badhta hai, phir har test pe zero pe snap back ho jaata hai.

Step 4 — Time $t$ pe broken hone ki probability: seedhi line

KYA. Pichle proof test ke $t$ ghante baad, device ke pehle se hi ek dangerous-undetected fault se broken hone ki kitni probability hai? Iss specific probability ko $P_{DU} (t)$ kehte hain — note karo ki yeh sirf $λ_{D U}$ se driven silent dangerous faults count karta hai, har possible failure nahi. Reliability theory se exact answer hai:

$P_{DU} (t) = 1 - e^{- λ_{D U} t}$

Yahan $e^{- λ_{D U} t}$ woh chance hai ki device koi dangerous-undetected fault ke bina survive kar gaya (exponential-survival curve of Failure Rate & Reliability); uss se ek minus karne pe woh chance aata hai ki aisi fault hui hai.

Line approximation kyun? Ek achhi safety device ke liye $λ_{D U} t$ chhota hota hai (1 se kaafi kam). Chhote $x$ ke liye, curve $1 - e^{- x}$ seedhi line $x$ ke saath chipka rehta hai:

$1 - e^{- x} \approx x when x ≪ 1$

Toh hum curve ko replace kar sakte hain

$P_{DU} (t) \approx λ_{D U} t$

Symbols padhna: $λ_{D U}$ (raindrop rate, Step 2) $\times$ $t$ (reset ke baad ghante) $=$ ab tak expected dangerous-undetected faults ka number $\approx$ probability ki kam se kam ek land kiya. Ek rate times ek time probability deta hai — units cancel ho jaate hain: $hr^{- 1} \times hr = 1$ .

PICTURE. True exponential curve aur uski straight-line substitute un jagahon pe almost ek doosre ke upar lie karte hain jahan hum care karte hain.

Step 5 — Picture hi ek triangle hai; answer uski average height hai

KYA. Ek interval ke dauran risk $P_{DU} (t) = λ_{D U} t$ shuru hoti hai $0$ pe (abhi test hua) aur badhti hai $λ_{D U} T_{1}$ tak (agla test aane se pehle). Hum is risk ka average jaanna chahte hain poore interval ke across — aur woh average hi $P F D_{a v g}$ hai, kyunki ek demand interval ke andar kisi bhi waqt aa sakti hai.

Average kyun, aur /2 kyun? Device hamesha peak risk pe nahi hoti — woh usually beech mein kahin hoti hai. Ek seedhi line ka average jo $0$ se peak $H$ tak jaati hai simply $H /2$ hota hai — midpoint. Yahi hai mysterious factor $\frac{1}{2}$ ka poora origin: triangle ka area half base times height hota hai.

PICTURE. Risk-vs-time graph ek right triangle hai: base $T_{1}$ , height $λ_{D U} T_{1}$ . Average height (dashed line) exactly halfway pe baithe hai.

$P F D_{a v g} = interval pe spread \frac{1}{T _{1}} \int_{0}^{T_{1}} risk P_{DU} (t) λ_{D U} t d t$

$\frac{1}{T _{1}} \int_{0}^{T_{1}} (\dots) d t$ ka matlab "time-average" kyun hai? Numbers ki ek list ka average socho: sab ko add karo, phir kitne hain ussse divide karo. Yahan "list" har instant $t$ pe risk value hai; integral $\int_{0}^{T_{1}} λ_{D U} t d t$ sab instants pe risk add karta hai (yeh shaded triangle ka area hai), aur length $T_{1}$ se divide karna kitne instants hain ussse divide karta hai. Sum ÷ count = average. Isliye area ko $1/ T_{1}$ se multiply karna poore triangle ko ek single average height mein compress kar deta hai.

$\int_{0}^{T_{1}} λ_{D U} t d t = λ_{D U} \frac{T _{1}^{2}}{2} \Rightarrow P F D_{a v g} = \frac{1}{T _{1}} \cdot λ_{D U} \frac{T _{1}^{2}}{2} = \frac{λ _{D U} T _{1}}{2}$

Ek $T_{1}$ cancel ho jaata hai, clean result milta hai. $\frac{T _{1}^{2}}{2}$ literally $\frac{1}{2} \times base \times height$ hai calculus mein likha hua.

Step 6 — Numbers daalo: ek SIL ko aate dekho

KYA. Parent ka example use karo: $λ_{D U} = 1 0^{- 6} hr^{- 1}$ , yearly test $T_{1} = 8760 hr$ .

$P F D_{a v g} = \frac{1 0 ^{- 6} \times 8760}{2} = \frac{8.76 \times 1 0 ^{- 3}}{2} = 4.38 \times 1 0^{- 3}$

Yeh kyun matter karta hai. $4.38 \times 1 0^{- 3}$ band $[1 0^{- 3}, 1 0^{- 2})$ mein land karta hai, jise IEC 61508 SIL 2 kehta hai. Formula ne sirf ek probability nahi di — usne device ko safety ladder pe place kar diya.

PICTURE. Computed value SIL band ruler pe drop hui, SIL 2 slot mein glow kar rahi hai.

Step 7 — Edge & degenerate cases (jo parent ne skip kiye)

KYA & KYUN. Ek formula tabhi trustworthy hai jab hum jaante hain ki woh kahan toot-ta hai. Chaar scenarios:

PICTURE. Ek risk-vs-time chart pe chaaon sab cases: flat line (A), runaway-clipped-at-1 (B), collapsing triangle (C), aur saturation ceiling (D) red cap ki tarah.

Ek-picture summary

Upar sab kuch compress: raindrops ( $λ_{D U}$ ) ek rising line fill karte hain, proof test ( $T_{1}$ ) use sawtooth mein reset karta hai, ek tooth ek triangle hai jis ki average height $P F D_{a v g}$ hai (boxed answer), aur woh number SIL ladder pe drop hota hai.

Recall Feynman retelling — ek story ki tarah bolo

Socho ek rescue gadget hai jo bas baith ke wait karta hai. Har ghante ek bahut chhoti, chhoti si chance hai ki woh silently toot jaata hai bina kisi ko pata chale — woh steady chance-per-hour $λ_{D U}$ hai, jaise slow raindrops. Jitna zyada wait karta hai, utni zyada likely hai ki woh pehle se hi broken hai, toh "broken hone ki chance" zero se ek seedhi line mein badhti hai. Thode thode time baad ek insaan check karta hai aur fix karta hai — yeh proof test hai, $T_{1}$ ghante ke gaps mein, aur yeh risk ko zero pe snap back karta hai. Toh risk graph ek repeating triangle hai: ek check ke turant baad zero, agle se pehle sabse zyada. Kyunki ek rescue call kisi bhi random moment pe aa sakti hai, hum triangle ke across average risk ki parwah karte hain — woh average exactly $P F D_{a v g}$ hai — aur triangle ki average height sirf uski peak ki half hoti hai. Peak $= λ_{D U} T_{1}$ , toh average $= λ_{D U} T_{1} /2$ . Yahi poora formula hai. Yearly-test numbers daalo aur tumhe roughly $0.0044$ milta hai, jo device ko SIL 2 mein land karta hai. Do baar zyada test karo aur triangle ka base half ho jaata hai, toh risk half ho jaati hai. Aur agar kabhi test nahi kiya, toh triangle 1 se zyada badhne ki koshish karega — impossible — jo sirf humein yaad dilata hai ki straight-line shortcut tabhi kaam karta hai jab risk chhoti rehti hai.

Recall Khud check karo

$P F D_{a v g}$ exactly kya measure karta hai? ::: Woh average probability ki ek safety device already broken hai (ek dangerous-undetected fault se) jis waqt ek random demand aati hai — 0 aur 1 ke beech ek pure number. $P F D_{a v g}$ mein one-half ka factor kyun hai? ::: Kyunki risk 0 se linearly peak tak badhti hai, aur ek seedhe ramp ka average uska midpoint hota hai — triangle ka area $\frac{1}{2} base \times height$ hota hai. $λ_{D U}$ ka matlab kya hai aur iske units kya hain? ::: Dangerous-undetected failures ki rate, $hr^{- 1}$ mein; yeh hidden faults ki "raindrop" pace hai. $\frac{1}{T _{1}} \int_{0}^{T_{1}} (\dots) d t$ time-average kyun deta hai? ::: Integral har instant pe risk sum karta hai (area), aur interval length $T_{1}$ se divide karna "kitne" instants hain usse divide karta hai — sum ÷ count = average. Formula kahan valid rehna band ho jaata hai? ::: Jab $λ_{D U} T_{1}$ chhota nahi rehta — true probability 1 pe saturate ho jaati hai jabki line badhti rehti hai, toh linear formula sirf small-risk region mein kaam karta hai.

Yeh bhi dekho: Code Coverage Metrics · Fault Tolerance & Redundancy · FMEA & Hazard Analysis · V-Model Software Lifecycle · Real-Time Operating Systems.