Safety-critical standards — DO-178C (airborne software), IEC 61508, ISO 26262: Worked examples

5.5.18 · D3 · Coding › Embedded Systems & Real-Time Software › Safety-critical standards — DO-178C (airborne software), IEC

Intuition Ye page kya hai

Parent note ne aapko machinery di thi: DAL coverage drive karta hai, SIL ek probability $P F D_{a v g} = λ_{D U} T_{1} /2$ se aata hai, ASIL $S \times E \times C$ se aata hai. Yahan hum us machinery ko har case class par run karte hain — har SIL band, har degenerate input (zero failure rate, zero test interval, redundant channels), QM corner sameti har ASIL cell, plus ek word problem aur ek exam twist. Kuch bhi compute karne se pehle, ek reminder plain words mein taaki koi symbol unearned na rahe:

DAL = Design Assurance Level — DO-178C airborne-software criticality grade (A = catastrophic … E = no effect). Hum ise Example 8 mein use karte hain.
$λ_{D U}$ ("lambda-D-U") = wo rate jis par dangerous, undetected faults appear hote hain, "faults per hour" mein measure hoti hai. Agar ye $1 0^{- 6}$ /hr hai, toh ek ghante mein roughly ek-in-a-million chance hai ki ek killer fault silently andar aa jaaye.
$T_{1}$ = proof-test interval hours mein — poori inspections ke beech ka waqt jo aisi hidden fault ko pakad le aur clock reset kar de.
$P F D_{a v g}$ = Probability of Failure on Demand, averaged — "agar safety function ko abhi, ek random moment par call kiya jaaye, toh kya chance hai ki wo already secretly broken hai?" 0 aur 1 ke beech ek pure number.

Reference tables (thresholds ek baar, shuru mein hi state kar dete hain)

Neeche har SIL classification in do tables se read hoti hai. Dono IEC 61508 Part 1, Table 2 (low demand) aur Table 3 (high/continuous demand) mein define hain. Inhe yahan state karte hain taaki kisi example ko inhe smuggle na karna pade.

Scenario matrix

Is topic ke har case in cells mein se kisi ek mein aata hai. Neeche ke 8 worked examples uss cell se labelled hain jo wo cover karta hai.

#	Case class	Tricky kyon hai	Covered by
C1	SIL from $P F D_{a v g}$ — mid band	plug-and-classify	Ex 1
C2	SIL — band boundary par landing	kya $1 0^{- 3}$ SIL 2 hai ya SIL 3?	Ex 2
C3	Degenerate input: $λ_{D U} = 0$ ya $T_{1} = 0$	limit → $P F D_{a v g} \to 0$	Ex 3
C4	Inverse problem: target SIL diya, max $T_{1}$ nikalo	variable ke liye solve karo	Ex 4
C5	High-demand mode mein PFH use hota hai, PFD nahi	wrong metric trap	Ex 5
C6	$S, E, C$ grid mein ASIL derivation, QM corner sameta	table lookup, all-low case	Ex 6
C7	ASIL decomposition — D ko do channels mein split karna	independence condition	Ex 7
C8	DO-178C MC/DC test count for a compound decision	$n + 1$ vs $2^{n}$	Ex 8
C9	Cross-standard exam twist: "A" ke opposite meanings hain	scale ki direction	Ex 8

Us grid ko ek checklist ki tarah padho. Example 8 tak har cell tick ho jaata hai.

Example 1 — Cell C1: mid-band $P F D_{a v g}$ se SIL

Worked example Statement

Ek low-demand emergency shutdown valve ka $λ_{D U} = 2 \times 1 0^{- 7}$ /hr hai aur use har 6 months ( $T_{1} = 4380$ hr) mein proof-test kiya jaata hai. Wo kaun sa SIL achieve karta hai?

Forecast: aage padhne se pehle SIL band guess karo. (Hint: numbers parent ke SIL 2 example se chhote hain — zyada integrity expect karo.)

Interval ko hours mein convert karo. 6 months $\approx 4380$ hr. Ye step kyon? $λ_{D U}$ per hour hai, isliye $T_{1}$ bhi hours mein hona chahiye warna units cancel nahi honge.
Boxed formula apply karo $P F D_{a v g} = \frac{λ _{D U} T _{1}}{2}$ : $P F D_{a v g} = \frac{( 2 \times 1 0 ^{- 7} ) ( 4380 )}{2} = \frac{8.76 \times 1 0 ^{- 4}}{2} = 4.38 \times 1 0^{- 4}$ Ye step kyon? Ye average "already-broken" probability hai jo parent mein $\frac{1}{T _{1}} \int_{0}^{T_{1}} λ_{D U} t d t$ se derive ki gayi thi.
Band read karo upar diye low-demand table se. $4.38 \times 1 0^{- 4}$ ka value $[1 0^{- 4}, 1 0^{- 3})$ mein hai → SIL 3. Ye step kyon? SIL bands order-of-magnitude windows hain; locate karo ki number kis decade mein baithti hai.

Verify karo: $1 0^{- 4} \leq 4.38 \times 1 0^{- 4} < 1 0^{- 3}$ ✓. Units: $(1/hr) (hr) =$ dimensionless probability ✓. Sanity: $R R F = 1/ P F D_{a v g} \approx 2283$ , SIL-3 window $(1000, 10000]$ ke andar ✓.

Example 2 — Cell C2: band boundary par exactly landing

Worked example Statement

Engineered numbers: $λ_{D U} = 1 0^{- 6}$ /hr, $T_{1} = 2000$ hr. Toh $P F D_{a v g} = 1 0^{- 3}$ exactly. SIL 2 ya SIL 3?

Forecast: boundaries wahan hain jahan log slip karte hain. $1 0^{- 3}$ kis side ka hai?

Compute karo: $P F D_{a v g} = \frac{1 0 ^{- 6} \times 2000}{2} = 1 0^{- 3}$ . Ye step kyon? Confirm karo ki hum sach mein seam par hain, near nahi.
Low-demand table se bracket rule padho: $SIL 2 : 1 0^{- 3} \leq P F D_{a v g} < 1 0^{- 2}, SIL 3 : 1 0^{- 4} \leq P F D_{a v g} < 1 0^{- 3}$ Value $1 0^{- 3}$ SIL 2 ka left-closed bound ( $\leq$ ) satisfy karta hai lekin SIL 3 ka right-open bound ( $< 1 0^{- 3}$ ) fail karta hai. Ye step kyon? IEC 61508 ke bands purposely left-closed/right-open hain: lower SIL apna floor khud own karta hai. Isliye $1 0^{- 3} \to$ SIL 2.

Verify karo: dono mein plug karo: SIL 2 ko chahiye $1 0^{- 3} \leq 1 0^{- 3}$ ✓ aur $1 0^{- 3} < 1 0^{- 2}$ ✓. SIL 3 ko chahiye $1 0^{- 3} < 1 0^{- 3}$ ✗. Sirf SIL 2 hold karta hai → unambiguous.

Is figure se kya lena hai: ye charon low-demand SIL decades ko ek number line par rakhta hai taaki aap dekh sako ki risk left ki taraf decrease hoti hai. Orange marker exactly SIL2/SIL3 seam par

1 0^{- 3}

par baitha hai; kyunki us seam ka bracket SIL-2 side par closed hai, marker SIL 2 ki tarah colour hai — boundary rule ka ek visual proof jo aapne abhi apply kiya.

Example 3 — Cell C3: degenerate inputs (limiting cases)

Worked example Statement

Do thought-experiment corner cases: (a) Ek component jiska $λ_{D U} = 0$ hai (ek perfect channel imagine karo jiska koi dangerous-undetected failure mode nahi). (b) Ek system jo continuously self-tested hai isliye effectively $T_{1} \to 0$ . Dono limits mein $P F D_{a v g}$ kya hai, aur kaun sa SIL?

Forecast: algebra se pehle dono answers guess karo — "no hidden faults" ya "test constantly" risk ko kya karta hai?

Case (a): $P F D_{a v g} = \frac{0 \cdot T _{1}}{2} = 0$ kisi bhi $T_{1}$ ke liye. Ye step kyon? Agar koi dangerous-undetected fault kabhi arise hi nahi kar sakta, toh safety function kabhi secretly broken nahi hoti. $P F D_{a v g} = 0$ har SIL band ke floor ko beat karta hai.
Case (b): $T_{1} \to 0 lim \frac{λ _{D U} T _{1}}{2} = 0$ . Ye step kyon? Zyada se zyada test karte rehne se undetected exposure ki window kuch nahi reh jaati. Limit (a) jaisi hi hai.
Limit ko honestly interpret karo. $P F D_{a v g} = 0$ mathematical hai; real components ka $λ_{D U} > 0$ hota hai aur tests finite time lete hain, isliye practice mein $P F D_{a v g} > 0$ hamesha hoga. Formula aapko direction batata hai: $λ_{D U}$ kam karo (better parts) ya $T_{1}$ kam karo (zyada test karo). Ye step kyon? Cell C3 isliye exist karta hai taaki aap kabhi "infinite SIL" nahi report karo — aap limiting behaviour aur uska practical meaning report karo.

Verify karo: derivative sanity — $\frac{\partial P F D _{a v g}}{\partial T _{1}} = \frac{λ _{D U}}{2} > 0$ : risk linearly badhti hai interval ke saath, isliye $T_{1} \to 0$ push karna risk ko kam karta hai, limit se match karta hai ✓. Dono corner values $0$ ke equal hain ✓.

Example 4 — Cell C4: inverse problem ( $T_{1}$ ke liye solve karo)

Worked example Statement

Ek designer ko ek valve ke saath SIL 3 achieve karna hi hai jiska $λ_{D U} = 5 \times 1 0^{- 7}$ /hr hai. Sabse lamba allowed proof-test interval $T_{1}$ kya hai?

Forecast: lamba interval = zyada risk, isliye $T_{1}$ par ek ceiling hai. Uske order of magnitude ka estimate karo (hazaron ghante? das hazaron?).

Requirement state karo low-demand table se. SIL 3 demand karta hai $P F D_{a v g} < 1 0^{- 3}$ . Ye step kyon? SIL 3 ka upper bound binding constraint hai (hum worst allowed chahte hain, yaani largest $T_{1}$ , yaani band ke andar largest $P F D_{a v g}$ ).
Formula ko boundary par set karo aur $T_{1}$ ke liye solve karo: $\frac{λ _{D U} T _{1}}{2} < 1 0^{- 3} \Rightarrow T_{1} < \frac{2 \times 1 0 ^{- 3}}{λ _{D U}} = \frac{2 \times 1 0 ^{- 3}}{5 \times 1 0 ^{- 7}} = 4000 hr$ Ye step kyon? Rearrange karne se unknown isolate hota hai. $λ_{D U}$ se division valid hai kyunki $λ_{D U} > 0$ .
Sahi strictness ke saath report karo. $T_{1} < 4000$ hr (lagbhag 166 din). Exactly $4000$ hr par aap $P F D_{a v g} = 1 0^{- 3}$ par honge, jo — Ex 2 se — SIL 2 hai, isliye strictly below choose karo. Ye step kyon? Ex 2 mein seekhi boundary discipline phir apply hoti hai; yahan " $\leq$ " silently aapko demote kar deta.

Verify karo: back-substitute karo $T_{1} = 4000$ : $P F D_{a v g} = \frac{5 \times 1 0 ^{- 7} \times 4000}{2} = 1 0^{- 3}$ (SIL2 edge) ✓, confirm hota hai ki SIL 3 ke liye $T_{1}$ strictly less hona chahiye. Units: $\frac{dimensionless}{1/hr} = hr$ ✓.

Example 5 — Cell C5: high-demand mode mein PFH use hota hai (metric trap)

Worked example Statement

Ek steer-by-wire controller continuously act karta hai (har control cycle mein). Uska dangerous-failure rate $λ_{D} = 3 \times 1 0^{- 8}$ /hr hai. Ek colleague $P F D_{a v g}$ compute karta hai aur ek SIL report karta hai. Error kahan hai, aur sahi SIL kya hai?

Forecast: parent note ne modes ko low-demand → PFD aur high/continuous → PFH mein split kiya tha. Yahan kaun sa apply hota hai?

Mode identify karo. Continuous operation ⇒ high-demand ⇒ metric hai PFH (probability of dangerous failure per hour), $P F D_{a v g}$ nahi. Ye step kyon? $P F D_{a v g}$ answer karta hai "broken when called rarely"; ek continuously-running function har instant "call" hoti hai, isliye per-hour rate meaningful measure hai. Yahan PFD use karna trap hai.
Upar state kiya high-demand PFH table use karo (IEC 61508 Part 1, Table 3): $SIL 3 : 1 0^{- 8} \leq P F H < 1 0^{- 7}$ Hamara $P F H \approx λ_{D} = 3 \times 1 0^{- 8}$ /hr us window mein aata hai. Ye step kyon? Continuously-operating channel ke liye dangerous-failure rate hi first order par per-hour failure probability hai — exactly yahi PFH table ke against calibrated hai.
Report karo: $3 \times 1 0^{- 8}$ /hr → SIL 3 (high-demand table). Colleague ka PFD number dimensionally ek probability hota, rate nahi — ek category error. Ye step kyon? Wrong metric naam lena system ko misclassify karta hai; ise pakadna cell C5 ka poora point hai.

Verify karo: $1 0^{- 8} \leq 3 \times 1 0^{- 8} < 1 0^{- 7}$ ✓. Units check: PFH carry karta hai units 1/hr (ek rate); PFD dimensionless hai — dono interchange nahi ho sakte, colleague ki mistake confirm hoti hai ✓.

Example 6 — Cell C6: $S, E, C$ grid mein ASIL, QM corner sameta

Worked example Statement

$S$ (severity 0–3), $E$ (exposure 0–4), $C$ (controllability 0–3) use karke do automotive hazards classify karo: (a) Motorway par unintended airbag deployment: $S 3, E 4, C 3$ . (b) Radio volume stuck low: $S 0, E 4, C 0$ .

Forecast: inme se ek sabse deadly ASIL hai, doosra safety goal hi nahi. Kaun sa kaun sa hai?

Mapping direction yaad karo. Higher $S$ , $E$ , $C$ higher ASIL ki taraf push karte hain (A<B<C<D); ek all-benign scenario QM (Quality Management — normal quality, koi safety requirement nahi) mein collapse hota hai. Ye step kyon? ASIL derive hota hai, decree se assign nahi hota — aap $(S, E, C)$ ISO 26262 risk table se read karte ho.
Case (a): $S 3$ (fatal), $E 4$ (motorways roz ki baat hai), $C 3$ (achanak airbag uncontrollable hai) — har axis ka top → ASIL D. Ye step kyon? Sabse worst credible triple table ke maximum cell par baitha hai.
Case (b): $S 0$ matlab koi injury possible nahi. Jis moment $S = 0$ ho (ya $E = 0$ ), outcome QM hai chahe baaki do kuch bhi hon. Ye step kyon? Koi severity nahi ⇒ koi safety goal nahi; ISO 26262 kehta hai aise items ordinary quality processes se handle hote hain, safety lifecycle se nahi.

Verify karo: consistency check — (a) ka $S 3$ neeche $S 0$ karo aur wo bhi QM ban jaata hai, confirm karta hai $S$ ek gating factor hai; (b) mein $S 0$ raho lekin $E, C$ badhao aur wo QM rehta hai, confirm karta hai " $S = 0 \Rightarrow$ QM" rule ✓.

Is figure se kya lena hai: ye

S

(severity) aur

E

(exposure) axes ko ek grid ki tarah rakhta hai aur har cell ko uske ASIL ke hisaab se colour karta hai. Left-to-right aur bottom-to-top padhne par, colour red top-right corner (S3,E4,C3 = ASIL D) ki taraf intensify hota hai, jabki leftmost

S 0

column poora gray = QM rehta hai. Ye picture "

S = 0

sab kuch QM par gate karta hai" rule ko ek solid gray stripe ki tarah visible banati hai.

Example 7 — Cell C7: ASIL decomposition (burden split karna)

Worked example Statement

Ek ASIL D braking function ek monolith ki tarah build karna bahut expensive hai. Team do independent subsystems propose karta hai. Ek valid decomposition do aur required independence condition state karo.

Forecast: kya do "saste" pieces sach mein D mein add up ho sakte hain? Unke baare mein kya true hona chahiye?

Decomposition rule yaad karo. ASIL D ko ASIL D = ASIL C(D) + ASIL A(D) ya ASIL B(D) + ASIL B(D) ki tarah split kiya ja sakta hai. "(D)" tag original goal yaad rakhta hai. Ye step kyon? Decomposition rigor redistribute karta hai, ye system goal ko lower nahi karta — notation ye track karta hai.
B(D) + B(D) choose karo. ASIL B rigor par develop ki gayi do independent channels milke ASIL D requirement satisfy karti hain. Ye step kyon? Symmetric split common hai jab dono channels similar hote hain (jaise do sensors voting kar rahe ho).
Non-negotiable condition state karo: dono elements sufficiently independent — common-cause failure se free hone chahiye. Agar ek single fault (shared power rail, shared clock, shared bug) dono ko mar sake, toh decomposition invalid hai aur aap full ASIL D ki zaroorat par wapas aa jaate ho. Ye step kyon? Poori saving independence par tiki hai; Fault Tolerance & Redundancy aur FMEA & Hazard Analysis precisely ise prove karne ke liye exist karte hain.

Verify karo: tags ka "arithmetic" — decomposition valid hai tabhi jab letter-levels combine hokar D tak pahunche: $B + B$ , $C + A$ , aur $D + QM$ sanctioned D-splits hain; jaise $A + A$ (≈ B) D tak nahi pahuncha, isliye reject ho jaata hai ✓. Rule ek lookup hai, free addition nahi.

Example 8 — Cells C8 & C9: MC/DC test count + "kaun sa A deadly hai" twist

Worked example Statement

Part 1 (C8): Flight-control decision if (A && B && C) (n = 3 conditions) ke liye MC/DC ko kitne tests chahiye, exhaustive testing se compare karke? Part 2 (C9): Ye code DAL A hai. Ek car team kehta hai unka code ASIL A hai. Kya car ke software ko same rigor ke liye hold kiya jaata hai?

Forecast: MC/DC count guess karo (2? 4? 8?) aur guess karo ki kya "A = A" dono standards mein same hai.

MC/DC count. MC/DC chahta hai ki har condition independently outcome flip kare → typically $n + 1$ tests. $n = 3$ ke liye: $4$ tests. Ye step kyon? Do conditions fixed rakhte hue teesri toggle karo ye prove karne ke liye ki sirf woh teesri result control karti hai — har condition ke liye repeat karo, plus ek shared baseline → $n + 1$ .
Exhaustive se compare karo. 3 booleans ke sabhi combinations = $2^{n} = 2^{3} = 8$ . Ye step kyon? MC/DC ki genius hai near-exhaustive fault-catching ( $4$ ) far below exhaustive cost ( $8$ ) par — gap tezi se barhta hai: $n = 10$ deta hai MC/DC $11$ vs exhaustive $1024$ . Coverage hierarchy ke liye Code Coverage Metrics dekho.
Part 2 — direction twist, poora answer. DO-178C mein, DAL is order mein hai ki A = most critical (ek catastrophic, hull-loss failure) aur E = no effect. ISO 26262 mein, ASIL ulti taraf order mein hai: A = least critical aur D = most critical. Isliye DAL A code aviation ke toughest rigor ka samna karta hai (MC/DC, most objectives, most independence), jabki ASIL A code automotive safety ka gentlest level face karta hai (QM se thoda hi upar). Dono letters identical lagte hain lekin apne scales ke opposite ends par baithe hain — isliye nahi, car ke software ko same rigor ke liye hold nahi kiya jaata; use bahut kam pe hold kiya jaata hai. Lesson: ek criticality letter meaningless hai jab tak aap uska standard name nahi karte. Ye step kyon? Ye parent ki headline mistake hai ("A ka opposite meaning hai"), aur cell C9 tabhi close hota hai jab comparison verdict explicitly state ho — jo ab ho gaya hai.

Verify karo: MC/DC formula check $n + 1$ : $n = 2 \Rightarrow 3$ (parent ke A && B example se match karta hai), $n = 3 \Rightarrow 4$ ✓; exhaustive $2^{3} = 8$ ✓; aur $4 < 8$ isliye MC/DC cheaper hai ✓. Direction: DAL rank (A highest) vs ASIL rank (D highest) — non-equal orderings confirm karte hain "A≠A" ✓.

Recall

Recall Har band boundary

$1 0^{- 3}$ kaun se SIL ki hai? Boundary $1 0^{- 3}$ SIL 2 ki hai (uska band left-closed $1 0^{- 3} \leq P F D < 1 0^{- 2}$ hai; SIL 3 right-open $< 1 0^{- 3}$ hai). ::: SIL 2 [!recall]- n conditions ke liye MC/DC test count kya hai? $n + 1$ (vs $2^{n}$ exhaustive). ::: n+1 [!recall]- $λ_{D U} = 0$ hone par $P F D_{a v g} =$ ? $0$ — ek perfect (koi dangerous-undetected fault nahi) channel kabhi secretly broken nahi hota. ::: 0 [!recall]- Continuous-demand functions kaun sa metric use karti hain? PFH (per-hour rate), PFD nahi. ::: PFH [!recall]- $S = 0$ hone par ASIL kya hota hai? QM (koi safety goal nahi). ::: QM [!recall]- Kya DAL A aur ASIL A same rigor hain? Nahi — DAL A most critical hai (aviation), ASIL A least critical hai (automotive); opposite ends. ::: No, opposite ends

Prerequisite & sibling links: Functional Safety · Code Coverage Metrics · Failure Rate & Reliability · Fault Tolerance & Redundancy · FMEA & Hazard Analysis · V-Model Software Lifecycle · Real-Time Operating Systems