Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262: Worked examples

Intuition What this page is

The parent note gave you the machinery: DAL drives coverage, SIL comes from a probability $P F D_{a v g} = λ_{D U} T_{1} /2$ , ASIL comes from $S \times E \times C$ . Here we run that machinery on every case class — every SIL band, every degenerate input (zero failure rate, zero test interval, redundant channels), every ASIL cell including the QM corner, plus a word problem and an exam twist. Before we compute anything, one reminder in plain words so no symbol is unearned:

DAL = Design Assurance Level — the DO-178C airborne-software criticality grade (A = catastrophic … E = no effect). We use it in Example 8.
$λ_{D U}$ ("lambda-D-U") = the rate at which dangerous, undetected faults appear, measured in "faults per hour." If it is $1 0^{- 6}$ /hr, then in one hour there is roughly a one-in-a-million chance a killer fault sneaks in silently.
$T_{1}$ = the proof-test interval in hours — the time between full inspections that would catch such a hidden fault and reset the clock.
$P F D_{a v g}$ = Probability of Failure on Demand, averaged — "if the safety function were called right now, at a random moment, what is the chance it is already secretly broken?" A pure number between 0 and 1.

The reference tables (state the thresholds ONCE, up front)

Every SIL classification below reads off these two tables. Both are defined in IEC 61508 Part 1, Table 2 (low demand) and Table 3 (high/continuous demand). State them here so no example has to smuggle them in.

The scenario matrix

Every case this topic can throw at you falls into one of these cells. The 8 worked examples below are labelled with the cell(s) they cover.

#	Case class	What makes it tricky	Covered by
C1	SIL from $P F D_{a v g}$ — mid band	plug-and-classify	Ex 1
C2	SIL — landing on a band boundary	is $1 0^{- 3}$ SIL 2 or SIL 3?	Ex 2
C3	Degenerate input: $λ_{D U} = 0$ or $T_{1} = 0$	limit → $P F D_{a v g} \to 0$	Ex 3
C4	Inverse problem: given target SIL, find max $T_{1}$	solve for the variable	Ex 4
C5	High-demand mode uses PFH, not PFD	wrong metric trap	Ex 5
C6	ASIL derivation across the $S, E, C$ grid incl. QM corner	table lookup, all-low case	Ex 6
C7	ASIL decomposition — splitting D into two channels	independence condition	Ex 7
C8	DO-178C MC/DC test count for a compound decision	$n + 1$ vs $2^{n}$	Ex 8
C9	Cross-standard exam twist: "A" means opposite things	direction of the scale	Ex 8

Read that grid as a checklist. By Example 8 every cell is ticked.

Example 1 — Cell C1: SIL from a mid-band $P F D_{a v g}$

Worked example Statement

A low-demand emergency shutdown valve has $λ_{D U} = 2 \times 1 0^{- 7}$ /hr and is proof-tested every 6 months ( $T_{1} = 4380$ hr). Which SIL does it achieve?

Forecast: guess the SIL band before reading on. (Hint: the numbers are smaller than the parent's SIL 2 example — expect more integrity.)

Convert the interval to hours. 6 months $\approx 4380$ hr. Why this step? $λ_{D U}$ is per hour, so $T_{1}$ must be in hours or the units won't cancel.
Apply the boxed formula $P F D_{a v g} = \frac{λ _{D U} T _{1}}{2}$ : $P F D_{a v g} = \frac{( 2 \times 1 0 ^{- 7} ) ( 4380 )}{2} = \frac{8.76 \times 1 0 ^{- 4}}{2} = 4.38 \times 1 0^{- 4}$ Why this step? This is the average "already-broken" probability derived in the parent from $\frac{1}{T _{1}} \int_{0}^{T_{1}} λ_{D U} t d t$ .
Read the band from the low-demand table above. $4.38 \times 1 0^{- 4}$ lies in $[1 0^{- 4}, 1 0^{- 3})$ → SIL 3. Why this step? SIL bands are order-of-magnitude windows; locate which decade the number sits in.

Verify: $1 0^{- 4} \leq 4.38 \times 1 0^{- 4} < 1 0^{- 3}$ ✓. Units: $(1/hr) (hr) =$ dimensionless probability ✓. Sanity: $R R F = 1/ P F D_{a v g} \approx 2283$ , inside the SIL-3 window $(1000, 10000]$ ✓.

Example 2 — Cell C2: landing exactly on a band boundary

Worked example Statement

Engineered numbers: $λ_{D U} = 1 0^{- 6}$ /hr, $T_{1} = 2000$ hr. So $P F D_{a v g} = 1 0^{- 3}$ exactly. SIL 2 or SIL 3?

Forecast: boundaries are where people slip. Which side does $1 0^{- 3}$ belong to?

Compute: $P F D_{a v g} = \frac{1 0 ^{- 6} \times 2000}{2} = 1 0^{- 3}$ . Why this step? Confirm we truly sit on the seam, not near it.
Read the bracket rule from the low-demand table: $SIL 2 : 1 0^{- 3} \leq P F D_{a v g} < 1 0^{- 2}, SIL 3 : 1 0^{- 4} \leq P F D_{a v g} < 1 0^{- 3}$ The value $1 0^{- 3}$ satisfies the SIL 2 left-closed bound ( $\leq$ ) but fails SIL 3's right-open bound ( $< 1 0^{- 3}$ ). Why this step? IEC 61508's bands are left-closed/right-open on purpose: the lower SIL owns its own floor. So $1 0^{- 3} \to$ SIL 2.

Verify: plug the boundary into both: SIL 2 needs $1 0^{- 3} \leq 1 0^{- 3}$ ✓ and $1 0^{- 3} < 1 0^{- 2}$ ✓. SIL 3 needs $1 0^{- 3} < 1 0^{- 3}$ ✗. Only SIL 2 holds → unambiguous.

What to take from this figure: it lays the four low-demand SIL decades on one number line so you can see that risk decreases to the left. The orange marker sits exactly on the SIL2/SIL3 seam at

1 0^{- 3}

; because that seam's bracket is closed on the SIL-2 side, the marker is coloured as SIL 2 — a visual proof of the boundary rule you just applied.

Example 3 — Cell C3: degenerate inputs (the limiting cases)

Worked example Statement

Two thought-experiment corner cases: (a) A component with $λ_{D U} = 0$ (imagine a perfect channel with no dangerous-undetected failure mode). (b) A system that is continuously self-tested so effectively $T_{1} \to 0$ . What is $P F D_{a v g}$ in each limit, and which SIL?

Forecast: guess both answers before the algebra — what does "no hidden faults" or "test constantly" do to the risk?

Case (a): $P F D_{a v g} = \frac{0 \cdot T _{1}}{2} = 0$ for any $T_{1}$ . Why this step? If no dangerous-undetected fault can ever arise, the safety function is never secretly broken. $P F D_{a v g} = 0$ beats every SIL band's floor.
Case (b): $T_{1} \to 0 lim \frac{λ _{D U} T _{1}}{2} = 0$ . Why this step? Testing more and more often shrinks the window of undetected exposure to nothing. The limit is the same as (a).
Interpret the limit honestly. $P F D_{a v g} = 0$ is mathematical; real components have $λ_{D U} > 0$ and tests take finite time, so $P F D_{a v g} > 0$ always in practice. The formula tells you the direction to push: lower $λ_{D U}$ (better parts) or lower $T_{1}$ (test more often). Why this step? Cell C3 exists so you never report a nonsense "infinite SIL" — you report the limiting behaviour and its practical meaning.

Verify: derivative sanity — $\frac{\partial P F D _{a v g}}{\partial T _{1}} = \frac{λ _{D U}}{2} > 0$ : risk rises linearly with interval, so pushing $T_{1} \to 0$ drives risk down, matching the limit ✓. Both corner values equal $0$ ✓.

Example 4 — Cell C4: the inverse problem (solve for $T_{1}$ )

Worked example Statement

A designer must achieve SIL 3 with a valve whose $λ_{D U} = 5 \times 1 0^{- 7}$ /hr. What is the longest allowed proof-test interval $T_{1}$ ?

Forecast: longer interval = more risk, so there is a ceiling on $T_{1}$ . Estimate its order of magnitude (thousands of hours? tens of thousands?).

State the requirement from the low-demand table. SIL 3 demands $P F D_{a v g} < 1 0^{- 3}$ . Why this step? SIL 3's upper bound is the binding constraint (we want the worst allowed, i.e. largest $T_{1}$ , i.e. largest $P F D_{a v g}$ still inside the band).
Set the formula at the boundary and solve for $T_{1}$ : $\frac{λ _{D U} T _{1}}{2} < 1 0^{- 3} \Rightarrow T_{1} < \frac{2 \times 1 0 ^{- 3}}{λ _{D U}} = \frac{2 \times 1 0 ^{- 3}}{5 \times 1 0 ^{- 7}} = 4000 hr$ Why this step? Rearranging isolates the unknown. Division by $λ_{D U}$ is legal because $λ_{D U} > 0$ .
Report with the correct strictness. $T_{1} < 4000$ hr (about 166 days). At exactly $4000$ hr you'd be at $P F D_{a v g} = 1 0^{- 3}$ , which — from Ex 2 — is SIL 2, so choose strictly below. Why this step? Boundary discipline learned in Ex 2 applies again; an " $\leq$ " here would silently demote you.

Verify: back-substitute $T_{1} = 4000$ : $P F D_{a v g} = \frac{5 \times 1 0 ^{- 7} \times 4000}{2} = 1 0^{- 3}$ (the SIL2 edge) ✓, confirming $T_{1}$ must be strictly less for SIL 3. Units: $\frac{dimensionless}{1/hr} = hr$ ✓.

Example 5 — Cell C5: high-demand mode uses PFH (metric trap)

Worked example Statement

A steer-by-wire controller acts continuously (every control cycle). Its dangerous-failure rate is $λ_{D} = 3 \times 1 0^{- 8}$ /hr. A colleague computes a $P F D_{a v g}$ and reports a SIL. Where's the error, and what is the right SIL?

Forecast: the parent note split modes into low-demand → PFD and high/continuous → PFH. Which applies here?

Identify the mode. Continuous operation ⇒ high-demand ⇒ the metric is PFH (probability of dangerous failure per hour), not $P F D_{a v g}$ . Why this step? $P F D_{a v g}$ answers "broken when called rarely"; a continuously-running function is "called" every instant, so a per-hour rate is the meaningful measure. Using PFD here is the trap.
Use the high-demand PFH table stated up front (IEC 61508 Part 1, Table 3): $SIL 3 : 1 0^{- 8} \leq P F H < 1 0^{- 7}$ Our $P F H \approx λ_{D} = 3 \times 1 0^{- 8}$ /hr falls in that window. Why this step? For a continuously-operating channel the dangerous-failure rate is the per-hour failure probability to first order — that is exactly what the PFH table is calibrated against.
Report: $3 \times 1 0^{- 8}$ /hr → SIL 3 (high-demand table). The colleague's PFD number would have been dimensionally a probability, not a rate — a category error. Why this step? Naming the wrong metric misclassifies the system; catching it is the whole point of cell C5.

Verify: $1 0^{- 8} \leq 3 \times 1 0^{- 8} < 1 0^{- 7}$ ✓. Units check: PFH carries units 1/hr (a rate); PFD is dimensionless — the two can't be interchanged, confirming the colleague's mistake ✓.

Example 6 — Cell C6: ASIL across the $S, E, C$ grid, including the QM corner

Worked example Statement

Classify two automotive hazards using $S$ (severity 0–3), $E$ (exposure 0–4), $C$ (controllability 0–3): (a) Unintended airbag deployment on the motorway: $S 3, E 4, C 3$ . (b) Radio volume stuck low: $S 0, E 4, C 0$ .

Forecast: one of these is the deadliest ASIL, the other isn't a safety goal at all. Which is which?

Recall the mapping direction. Higher $S$ , $E$ , $C$ push toward higher ASIL (A<B<C<D); an all-benign scenario collapses to QM (Quality Management — normal quality, no safety requirement). Why this step? ASIL is derived, not assigned by decree — you read $(S, E, C)$ off the ISO 26262 risk table.
Case (a): $S 3$ (fatal), $E 4$ (motorways are everyday), $C 3$ (a sudden airbag is uncontrollable) — the top of every axis → ASIL D. Why this step? The worst credible triple sits at the table's maximum cell.
Case (b): $S 0$ means no injury possible. The moment $S = 0$ (or $E = 0$ ), the outcome is QM regardless of the other two. Why this step? No severity ⇒ no safety goal; ISO 26262 says such items are handled by ordinary quality processes, not the safety lifecycle.

Verify: consistency check — swap (a)'s $S 3$ down to $S 0$ and it too becomes QM, confirming $S$ is a gating factor; keep $S 0$ but raise $E, C$ in (b) and it stays QM, confirming the " $S = 0 \Rightarrow$ QM" rule ✓.

What to take from this figure: it lays the

S

(severity) and

E

(exposure) axes as a grid and colours each cell by the ASIL it yields. Reading left-to-right and bottom-to-top, colour intensifies toward the red top-right corner (S3,E4,C3 = ASIL D), while the entire leftmost

S 0

column stays gray = QM. The picture makes the "

S = 0

gates everything to QM" rule visible as a solid gray stripe.

Example 7 — Cell C7: ASIL decomposition (splitting the burden)

Worked example Statement

An ASIL D braking function is too expensive to build as one monolith. The team proposes two independent subsystems. Give one valid decomposition and state the required independence condition.

Forecast: can two "cheaper" pieces really add up to D? What must be true about them?

Recall the decomposition rule. ASIL D may be split as ASIL D = ASIL C(D) + ASIL A(D) or ASIL B(D) + ASIL B(D). The "(D)" tag remembers the original goal. Why this step? Decomposition redistributes rigor, it does not lower the system goal — the notation tracks that.
Pick B(D) + B(D). Two independent channels each developed to ASIL B rigor together satisfy the ASIL D requirement. Why this step? Symmetric split is common when both channels are similar (e.g. two sensors voting).
State the non-negotiable condition: the two elements must be sufficiently independent — free of common-cause failure. If a single fault (shared power rail, shared clock, shared bug) can kill both, the decomposition is invalid and you're back to needing full ASIL D. Why this step? The whole saving rests on independence; Fault Tolerance & Redundancy and FMEA & Hazard Analysis exist precisely to prove it.

Verify: "arithmetic" of the tags — decomposition is valid only if the letter-levels combine back to D: $B + B$ , $C + A$ , and $D + QM$ are the sanctioned D-splits; e.g. $A + A$ (≈ B) does not reach D, so it's rejected ✓. The rule is a lookup, not free addition.

Example 8 — Cells C8 & C9: MC/DC test count + the "which A is deadly" twist

Worked example Statement

Part 1 (C8): For the flight-control decision if (A && B && C) (n = 3 conditions), how many tests does MC/DC require, versus exhaustive testing? Part 2 (C9): This code is DAL A. A car team says their code is ASIL A. Is the car's software held to the same rigor?

Forecast: guess the MC/DC count (2? 4? 8?) and guess whether "A = A" across the two standards.

MC/DC count. MC/DC needs each condition to independently flip the outcome → typically $n + 1$ tests. For $n = 3$ : $4$ tests. Why this step? Hold two conditions fixed while toggling the third to prove that third one alone controls the result — repeat per condition, plus a shared baseline → $n + 1$ .
Compare to exhaustive. All combinations of 3 booleans = $2^{n} = 2^{3} = 8$ . Why this step? MC/DC's genius is getting near-exhaustive fault-catching ( $4$ ) at far below exhaustive cost ( $8$ ) — the gap widens fast: $n = 10$ gives MC/DC $11$ vs exhaustive $1024$ . See Code Coverage Metrics for the coverage hierarchy.
Part 2 — the direction twist, answered in full. In DO-178C, DAL is ordered so that A = most critical (a catastrophic, hull-loss failure) and E = no effect. In ISO 26262, ASIL is ordered the other way: A = least critical and D = most critical. Therefore DAL A code faces the toughest aviation rigor (MC/DC, most objectives, most independence), while ASIL A code faces the gentlest automotive safety level (barely above QM). The two letters look identical but sit at opposite ends of their scales — so no, the car's software is not held to the same rigor; it is held to far less. The lesson: a criticality letter is meaningless until you name its standard. Why this step? This is the parent's headline mistake ("A means opposite things"), and cell C9 is only closed once the comparison verdict is stated explicitly — which it now is.

Verify: MC/DC formula check $n + 1$ : $n = 2 \Rightarrow 3$ (matches parent's A && B example), $n = 3 \Rightarrow 4$ ✓; exhaustive $2^{3} = 8$ ✓; and $4 < 8$ so MC/DC is cheaper ✓. Direction: DAL rank (A highest) vs ASIL rank (D highest) — non-equal orderings confirm "A≠A" ✓.

Recall

Recall Every band boundary

$1 0^{- 3}$ belongs to which SIL? Boundary $1 0^{- 3}$ is SIL 2 (its band is left-closed $1 0^{- 3} \leq P F D < 1 0^{- 2}$ ; SIL 3 is right-open $< 1 0^{- 3}$ ). ::: SIL 2 [!recall]- MC/DC test count for n conditions? $n + 1$ (vs $2^{n}$ exhaustive). ::: n+1 [!recall]- $λ_{D U} = 0$ makes $P F D_{a v g} =$ ? $0$ — a perfect (no dangerous-undetected fault) channel is never secretly broken. ::: 0 [!recall]- Continuous-demand functions use which metric? PFH (per-hour rate), not PFD. ::: PFH [!recall]- ASIL when $S = 0$ ? QM (no safety goal). ::: QM [!recall]- Is DAL A the same rigor as ASIL A? No — DAL A is the most critical (aviation), ASIL A is the least critical (automotive); opposite ends. ::: No, opposite ends

Prerequisite & sibling links: Functional Safety · Code Coverage Metrics · Failure Rate & Reliability · Fault Tolerance & Redundancy · FMEA & Hazard Analysis · V-Model Software Lifecycle · Real-Time Operating Systems