1. Safety-Critical Systems T 79.232 Ilkka Herttua

2. Safety Context Diagram HUMANPROCESS SYSTEM - Hardware - Software - Operating Rules

3. Critical Applications Computer based systems used in avionics, chemical process and nuclear power plants. A failure in the system endangers human lives directly or through environment pollution. Large scale economic influence.

4. Safety Definition Safety: Safety is a property of a system that it will not endanger human life or the environment. Safety-Critical System: A system that is intended to achieve, on its own, the necessary level of safety integrity for the implementation of the required safety functions.

5. Safety Definition Safety integrity: The likelihood of a safety-related system achieving its required safety features under all the stated conditions within a stated operational environment and within a stated period of time. SIL levels 0 to 4. SIL 4 is the highest safety integrity level.

6. Developing safety-related systems To achieve safety: - safety requirements - quality management - design / system architecture - defined design/manufacture processes - certification and approval processes - known behaviour of the system in all conditions

7. V - Lifecycle model System Acceptance System Integration & Test Module Integration & Test Requirements Analysis Requirements Model Test Scenarios Software Implementation & Unit Test Software Design Requirements Document Systems Analysis & Design Functional / Architechural - Model Specification Document Knowledge Base * * Configuration controlled Knowledge that is increasing in Understanding until Completion of the System: Requirements Documentation Requirements Traceability Model Data/Parameters Test Definition/Vectors

8. Safety Requirements Requirements are the stakeholders (customer) demands – what they want the system to do. Not defining how !!! Safety requirements are defining what the system must do and must not do in order to ensure safety. Positive and negative functionality.

9. Where do we go wrong? Many system failures are not failures to understand R ; they are mistakes in D –A NYC subway train crashed into the rear end of another train on 5th June 1995. The motorman ran through a red light. The safety system did apply the emergency brakes. However the...signal spacing was set in 1918, when trains were shorter, lighter and slower, and the emergency brake system could not stop the train in time. Or maybe D is deliberately subverted –“If you present a valid card and type the right PIN, you are entitled to withdraw £200” Are you sure?

10. Specification Supplier instructions how to build the system. Derived from the required functionality – requirements.

11. Verification and validation Verification is the process of determining that a system or module meets its specification. Validation is the process of determining that a system is appropriate for its purpose.

12. Fault, error and failure A fault is defect within the system. Random faults – hardware components, systematic faults – software/hardware design and manufacture processes. An error is a deviation from the required operation of the system or subsystem. A system failure occurs when the system fails to perform its required function. (Significant, major and minor)

13. Fault management Fault management techniques: Fault avoidance – in entire system design phase Fault removal - before system enters service Fault detection – during service to minimising effects Fault tolerance – operate correctly in the presence of faults

14. RAM Reliability is the probability of a component or system functioning correctly over a given period of time under a given set of operating conditions. (MTBF mean time between failure.) The availability of a system is the probability that the system will be functioning correctly at any given time. Maintainability: Maintenance is the action taken to retain a system in or return a system to its designed operating condition. (MTTR mean time to repair.)

15. Hazard Analysis A Hazard is situation in which there is actual or potential danger to people or to environment. Analytical techniques: - Failure modes and effects analysis (FMEA) - Failure modes, effects and criticality analysis (FMECA) - Hazard and operability studies (HAZOP) - Event tree analysis (ETA) - Fault tree analysis (FTA)

16. Home assignments 1.12 (primary, functional and indirect safety) 2.4 (unavailability) Email before 28. January to herttua@eurolock.org