Functional Safety and Timing Constraints

Functional Safety and Timing Constraints 5.2.1 Safety Aspects of Fault-Reaction-Time-Interval... 

Finally, the automotive industry like many other domains is driven by tight margins and time constraints. Once a project is underway, momentum increases quickly. It is therefore essential that the visibility of the project s technical and assurance attributes and any infringements identified early so that undesired consequences are addressed. This leads to the conclusion that the review and assessment of the safety case at key product gateways will not only keep focus on the emergence of the project s and product s safety attributes, but is more likely to have a safety case at the final functional safety assessment that is legible and more readily analysable. 

Hopp and Roof-Sturgis [55] study the problem of quoting shortest possible lead times subject to the service constraint Tmax- In their proposed due date policy (HRS), which is based on control chart methods, they break the lead time quote of job j into two components the mean flow time, which is a function of the number of jobs in the system at the arrival time of job j, plus a safety lead time, which is a function of the standard deviation of flow time. They use the following quadratic functions (applicable to a flow shop) to estimate the mean and the standard deviation of the flow time... 

An important problem in safety-critical software development results from its ever increasing complexity and from the fact that software functions often interact strongly with different contexts in event-based systems. This can be a physical context (e.g. a monitored and controlled device), human users in an organizational context, or other software and hardware (e.g. a device driver). Other factors increasing the complexity of this problem are asynchronous communication with and within the system, event-driven behaviour, complex data types, timing constraints, parallel execution and non-deterministic behaviour of the system under test. Testing event-driven software thus faces special challenges. In summary, the characteristics of event-driven, safety-critical software are ... 

The requirements specifications of monitoring and control systems often demand high levels of performance from a computational system. For example, the computational task may involve real-world data acquisition, combinational or sequential logic functions, complex arithmetic calculations, and the generation of control outputs to the application plant. The computational response may be required within very tight time constraints, perhaps as part of a real-time schedule. The schedule may have to be maintained in the presence of asynchronous external inputs, such as operator commands or alarms. In addition, the system may have to perform safety functions or functions with safety implications. 

Some of the functions listed are not always typical safety-related functions. Also, in case of a precise control or just for data or event-synchronizations, time-constraints must be considered. Especially in embedded systems several time-constraints could be required in different contexts within a single micro-controUer and multi-tasking principles must be applied. In case of multi-core applications, such requirements are relevant at least in order to manage common resources, such as peripheral elements, packaging, power-supply etc. 

Typical active safety functions such as for chassis control, where for example typical loops for the application software are required, higher scheduling applications are required. If the safety task requires a higher level ASIL and the application a lower level ASIL or even only QM (e.g. legacy code), timing constraints violate... 

The classic triple constraints of time, cost and functionality are well known in projects, but other constraints can be imposed. One interesting class that is particularly relevant in safety-critical systems development is standards. Quite often the use of a standard is described as a requirement but it isn t. What a standard does is constrain a project, possibly in multiple ways. The types of things standards impose on projects include process, tools, resourcing, product characteristics and governance activities, and essentially impact on the product produced. 

There is a set of constraints that operate within projects that, by definition, restrict what is achievable. These are time, cost and functionality - the triple constraints identified by Martin Barnes over forty years ago that he described using a triangle. The relationships between these are complex and, as a basic heuristic, only two can be set within a single project the third defines itself Applying theory of constraints concepts (Goldratt 1984), it would be reasonable to expect that functionality will become the overriding constraint in demonstrably safety-critical systems. 

In the optimization, the objective function is to maximize the product generated versus process time. The desired product was defined by endpoint equalities and inequalities, such as amount of unreacted components. In addition, the safety conditions required certain path-constraints for the state variables such as temperature. Unfortunately, we experienced optimization problems with the above formulation. The problems stem from getting stuck in infeasible regions due to complexity of the process and the nonlinearity of the objective function. At the moment, we are working to overcome these problems so that we can test the runaway behavior and cooler limitations with respect to optimization. 

Safety-related software has to satisfy stringent quality requirements. The complexity of software-implemented functionality grows at a fast pace. Development teams have to meet tight budget constraints and face increasing pressure to reduce time-to-market. To meet these conflicting goals the development process has to be sound and efficient. 

Other words, safety cannot be managed by imposing constraints on how work is done. The solution is instead to identify the situations where the variability of everyday performance may combine to create unwanted effects and continuously monitor how the system functions in order to intervene and dampen performance variability when it threatens to get out of control. At the same time, we should also keep an eye on situations where variability may have useful effects, and learn how to manage and reinforce that. 

Line 14 is a distribnted real-time complex system, the main function of which is to transport passengers, while guaranteeing high safety for travelers. The system needs to ensrtre that it meets certain functional constraints said to be safe [CHA 96], The real-time character reflects the fact that the railway system interacts with its physical enviromnent, the behavior of which is uninterruptible and irreversible in nature. 

---