Table Of Content

Embedded Software Development for Safety-Critical Systems Second Edition Embedded Software Development for Safety-Critical Systems Second Edition Chris Hobbs Coverphotoby: ChuckClark CRCPress Taylor&FrancisGroup 6000BrokenSoundParkwayNW,Suite300 BocaRaton,FL33487-2742 (cid:13)c 2020byTaylor&FrancisGroup,LLC CRCPressisanimprintofTaylor&FrancisGroup,anInformabusiness NoclaimtooriginalU.S.Governmentworks Printedonacid-freepaper InternationalStandardBookNumber-13: 978-0-367-33885-5(Paperback) Thisbookcontainsinformationobtainedfromauthenticandhighlyregardedsources. Rea- sonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the conse- quences of their use. The authors and publishers have attempted to trace the copyright holdersofallmaterialreproducedinthispublicationandapologizetocopyrightholdersif permissiontopublishinthisformhasnotbeenobtained.Ifanycopyrightmaterialhasnot beenacknowledgedpleasewriteandletusknowsowemayrectifyinanyfuturereprint. Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means,nowknownorhereafterinvented,includingphotocopying,microfilming,andrecord- ing,orinanyinformationstorageorretrievalsystem,withoutwrittenpermissionfromthe publishers. For permission to photocopy or use material electronically from this work, please access www.copyright.com(http://www.copyright.com/)orcontacttheCopyrightClearanceCen- ter, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not- for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system ofpaymenthasbeenarranged. Trademark Notice: Productorcorporatenamesmaybetrademarksorregisteredtrade- marks,andareusedonlyforidentificationandexplanationwithoutintenttoinfringe. Visit the Taylor & Francis Web site at http://www.taylorandfrancis.com and the CRC Press Web site at http://www.crcpress.com Dedication For Alexander, Thomas, and Edward (cid:1)(cid:2)(cid:3)(cid:3)' (cid:4)(cid:5)(cid:6)' (cid:7)(cid:3)(cid:8)(cid:1)(cid:9)(cid:10), (cid:7)(cid:3)(cid:3)' (cid:11)(cid:12)(cid:13)(cid:14)(cid:4)(cid:15) (cid:16)(cid:14) (cid:17)(cid:18)(cid:19)(cid:20) v Contents Preface ....................................................................xiii Software and Safety xiii References xiv Tools xv Second Edition xv Acknowledgments xvi About the Author xvii SECTION 1: BACKGROUND 1 Introduction...........................................................3 Safety Culture 4 Our Path 6 Selecting the Techniques to Describe 7 Development Approach 8 Today’s Challenges 10 References 12 2 Terminology of Safety............................................13 General Safety Terminology 13 Software-Specific Terminology 20 References 25 3 Safety Standards and Certification...........................27 Standards Bodies 27 Accreditation and Certification 29 Why Do We Need These Standards? 31 Goal- and Prescription-Based Standards 32 Functional Safety Standards 33 vii viii (cid:4) Contents IEC 62304 and ISO 14971 43 Machine Learning and SOTIF 45 Process and the Standards 49 Summary 50 References 51 4 Representative Companies......................................53 Alpha Device Corporation 53 Beta Component Incorporated 54 Using a Certified Component 54 SECTION 2: THE PROJECT 5 Foundational Analyses ...........................................59 Analyses 59 Interrelationships 60 Hazard and Risk Analysis 62 Safety Case 67 Failure Analysis 74 Analyses by Example Companies 80 Summary 83 References 84 6 Certified and Uncertified Components......................85 SOUP by Any Other Name 85 Certified or Uncertified SOUP 86 Using Non-Certified Components 87 Using a Certified Component 92 Aligning Release Cycles 93 Example Companies 93 SECTION 3: DESIGN PATTERNS 7 Architectural Balancing..........................................97 Availability/Reliability Balance 98 Usefulness/Safety Balance 99 Security/Performance/Safety Balance 101 Performance/Reliability Balance 103 Implementation Balance 103 Summary 104 References 104 8 Error Detection and Handling............................... 105 Why Detect Errors? 105 Error Detection and the Standards 106 Contents (cid:4) ix Anomaly Detection 106 Rejuvenation 122 Recovery Blocks 125 A Note on the Diverse Monitor 128 Summary 129 References 129 9 Expecting the Unexpected.................................... 131 Design Safe State 131 Recovery 134 Crash-Only Model 135 AnticipationoftheUnexpectedbytheExampleCompanies 136 Summary 137 References 137 10 Replication and Diversification.............................. 139 History of Replication and Diversification 140 Replication in the Standards 140 Component or System Replication? 140 Replication 142 Diversification 144 Virtual Synchrony 149 Locked-Step Processors 156 Diverse Monitor 157 Summary 159 References 160 SECTION 4: DESIGN VALIDATION 11 Markov Models................................................... 163 Markov Models 163 Markov Models and the Standards 164 The Markovian Assumptions 164 Example Calculation 165 Markovian Advantages and Disadvantages 170 References 171 12 The Fault Tree.................................................... 173 FTA and FMECA 173 Fault Tree Analysis in the Standards 174 Types of Fault Trees 174 Example 1: Boolean Fault Tree 175 Example 2: Extended Boolean Fault Tree 177 Example 3: Bayesian Fault Tree 178