In the avionics industry, the guidelines for creating safety critical software that must be certified by the airworthiness authorities as being safe for flight are encapsulated in the RTCA DO-178 document (previously DO-178B and latterly DO-178C). Fundamentally a process document, DO-178 defines the activities and metrics that must be obtained during the software development process, starting with a system safety assessment.

In the industrial domain, IEC 61508 is the general standard from which more domain specific standards for the railway, automotive, medical, industrial and nuclear industries have been derived. Like DO-178, IEC 61508 and its derivatives provide guidelines for creating safety critical software in the form of a process document that defines the activities and metrics that must be obtained during the software development process.

In all of these functional safety standards, the first step is to perform a system risk assessment. This is the process whereby the probability and severity of hazardous system events are enumerated.

The risk of something happening is relatively easily defined as probability, the severity is less obvious. As an illustration, consider a klaxon with a mean time to failure of 20 thousand operating hours. The eventual event of failure is inevitable. If that klaxon is used to signal the end of a shift then the impact of that failure is no more than an annoyance. However, if the same klaxon were used as an indicator upon the detection of thermal runaway in a nuclear power plant, then its failure could have serious consequences.

So, driven by this system safety assessment, functional safety standards’ guidelines ensure that the same level of rigour need not be applied to non-safety critical systems (e.g. flight entertainment system) as that used during the development of safety critical systems (e.g. a flight control system).

Although these functional safety standards are both vital and (especially in the case of DO-178) have proven hugely successful in achieving their aims, the Project Triangle with all its commercial pressures remains a constant burden. Clearly, the greater the level of rigor demanded, the more costly the development.

Dealing with risk and severity through functional safety standards

Get in touch