Software based systems

Failure Modes and Effects Analysis (FMEA) and its variants have been widely used in safety analyses for more than thirty years. With the increase of application domain of software intensive systems there was a natural tendency to extend the use of (originally developed for hardware systems) safety analysis methods to software based systems. 

Littlewood, B., Assessing the dependability of Software-based systems the importance role of confidence, KKIO 2004, Software Engineering Conference, Gdansk, 5-8 October, 2004, p. 13-14. 

Wingate, G.A.S., Smith, M., and Lucas, P.R. (1995), Assuring Confidence in Pharmaceutical Software, Safety and Reliability of Software Based Systems, First Annual ENCRESS Conference, Bruges, Belgium, September. 

Hatton, L. (1997), Unexpected (and Sometimes Unpleasant) Lessons from Data in Real Software Systems, Safety and Reliability of Software Based Systems, Springer-Verlag, Heidelberg, Germany. 

Goods and services, including software-based systems," mnst correspond to their description and be of a merchantable quality (ht for purpose). Both GxP regulatory requirements and commercial contract law share the objective of computer systems being fit for purpose, and this shonld be achieved through good professional practice. 

Lloyd, I.J. and Simpson, M.J. (1997), Computer Risks and Some Legal Consequences, in Safety and Reliability of Software Based System, Springer-Verlag, New York. 

Assessment of the investigator site prior to the start of the trial, including investigator-supphed software-based systems considering such issues as validation activities (plarmed and completed), level of understanding of GCP requirements for use of computerized systems, statement of level of comphance with 21 CFR Part 11, the presence of remediation plans if required, and cahbration and maintenance procedures... 

These dosing models use complex calculations that may prevent widespread adoption by clinicians. To facilitate the estimates, an Internet-based calculator has been implemented [46]. This system is not only capable of predicted final dose but also can be used to refine dosing once the first few INR measurements have been taken. Additionally, a software-based system has been developed that can model the pharmacokinetics of individual patients given their genotypes and INR measurements [47]. This system attempts to use these data to provide dosing attempting to get the INR into the desired... 

Thomd, B. (editor), 1993, Principles and Practice of Computer-based Systems Engineering, Wiley series in software based systems... 

Performing the FMEA for the Tihange 1 project has proved to be a good way to discuss in depth safety aspects of software-based systems with our customer and with the licensing authority. 

Contrary to the complex of upgrade and refurbishment procedures In this paper the term maintenance is used in the following marmer Maintenance is the combination of all measures which ensure the specified system function. Maintenance procedures should have a small effort and a limited duration. For safety reasons maintenance procedures in NPP can just take place in one redimdancy without reducing the availability of parallel systems as well as combined systems (e.g. CPU of software based systems) in an irregularly way. Consequently the update with new or modified SW-versions in this sense is no part of maintenance for safety systems. 

Whereas maintenance requirements for hardware in Germany are already existing or treated by business as usual , respectively, requirements for software-based systems are only partly treated in the national and international regulations. 

The following aspects of maintenance and modification of software-based systems are covered in [1]. 

As already mentioned, lEC 60880 describes the modification process for software in computer-based systems of the highest safety category. Taking into account, that most of the software-based systems important to safety are also to be installed in lower safety classes, the importance and necessity of... 

For software-based systems important to safety following questions are to be answered ... 

The overlying software-based system feeds the CMAC scheme (implemented in hardware) with the properly padded (when needed) input blocks Minput which are parts of the whole message that is intended to be protected for authentication. The padding process is a quite simple process that can be carried out by the software. This does not imply security problems since there is no secrecy or keys information that should be protected at this point. The initial unit part is the hardware component responsible for the conditional bitwise operation xor between the Mi pui and one of the subkeys Ki or K2. 

Littlewood 1993] Litdewood, Bev and Strigini, Lorenzo. Validation ofUltrahigh Dependability for Software-Based Systems. CACM 36(11) 69-80 (1993)... 

The Primary Protection System (PPS) for the Sizewell B Nuclear Power Plant (NPP) was the first safety-critical software based system to be used in a UK NPP. The software was developed by Westinghouse Electric and consisted of approximately 100,000 lines of software written in PL/M-86 and ASM-86 (a structured version of 8086 assembler). (There were additionally a further 100,000 lines of configuration data.) The software, not including the configuration data. 

SHOLIS (Chapman, 2000) is a software-based system that advises ship s crew on the safety of helicopter operations under various scenarios. The software was developed in accordance with DEF STAN 00-55 (Issue 2). A software hazard analysis was performed and on this basis certain parts of the software were designated as safety-critical. Safety critical software was formally specified using Z, developed in Spark Ada, and a partial correctness performed of the code against the specification. Information Flow analysis was used to demonstrate functional separation of critical and non-critical software. Freedom from run-time exceptions was demonstrated for all code. Static analysis of I/O usage, memory and timing was used to show separation of non-functional properties. Finally, proof that the system s top-level safety properties were maintained by the software was carried out. 

Littlewood 1993] B. Littlewood and L. Strigini, Assessment of ultra-high dependability for software-based systems , CACM, vol. 36, no. 11, pp.69-80, 1993. 

Littlewood B, Wright D (2007) The use of multi-legged arguments to increase confidence in safety claims for software-based systems a study based on a BBN of an idealized example. IEEE Trans Softw Eng 33 347-365... 

Kuhn D, Wallace D (2000) Failure modes in medical device software an analysis of 15 years of recall data. Nat. Institute of Standards and Technology, Gaithersburg, MD USA. http //csrc. nist.gov/staff/Kuhn/final-rqse.pdf. Accessed 25 August 2010 Littlewood B, Strigini L (1993) Validation of ultrahigh dependability for software-based systems. Comm. ACM 36(11) 69-80... 

Defence in depth as applied in the design of nuclear power plants [1, 10] should be used in the development of the computer based system and its associated software. If a software based system constitutes the main safety feature, defence in depth, for example by means of a diverse secondary protection system, should be provided. 

Integrated software systems for matching shelf stock to expectations A software-based system that corrects shelf inventory levels based on actual product present (possible RFID solution). Identifies stock-outs from shrinkage or item misplacement. 6-Functional supply chain processes (source and make) X o o... 

A software-based system that corrects shelf inventory levels based on actual product present (possible RFIDsolution). Identifies stock-outs from shrinkage or item misplacement. 

Cyber-attack (the security problem). The requirement to ensure that software-based systems are protected from malicious attack has become a significant new area of work in the development of high-integrity systems. 

Demonstration of the claimed reliability (the reliability problem). As already discussed in pages 14 and 15, software-based systems are assigned reliabilities on the basis of the quality management techniques and measures employed during the system design. If we now seek to substantiate these reliabilities by statistical testing, we run into the difficulty created by the validation problem (issue 5) above. In principle, to demonstrate high reliabilities, each function would have to be tested, in each and every plant state, thousands of times. 

When there are two "N. diverse software-based systems, does it actually improve the risk of software common-mode failure ... 

The operational environment which covers operational use of software-based systems. 

Software-based systems have grown and grown in recent years, and systems with many ntiUions of lines of application software are now common. With software of this size and complexity, it becomes very difficult indeed for any one person to have a... 

No specific reliability/availability targets are set against each of these categories or classes. There is however a maximum limit set for software-based systems of 10 " PFD. More generally the reliability/availability targets are set in the Plant Safety Design Base and can be set either quantitatively or qualitatively. There is a preference for quantitative plus basic requirements on layers and types of protection. 

---