Software criticality analysis

May 1996 FDA 483 Failure to identify and analyze the system/software critical functions. No documented risk assessment and hazard analysis was done. .. ... 

After the PHA is complete, first subsystem hazard analysis (SSHA) and, if required, system hazard analysis (SHA) are performed. Depending on the nature and complexity of the end product and the results of the PHA, SSHAs may be performed on all subsystems or just on selected critical subsystems. Unlike MIL-STD-882B, software analyses are not generally identified separately. If applicable, preliminary software hazard analysis is part of the PHA. Software should be treated as a subsystem and, if further software analysis is required, an SSHA can be performed on the software. 

Based on the results of the PHA, recommendations made by 30% review boards, and guidance provided in the system safety program plan, detailed hazard analyses are made of specified (critical) subsystems. The techniques for these SSHAs are as outlined in the system safety program plan or as selected by the SSWG. Failure modes and effects analysis (FMEA) and/or fault tree analysis (FTA) are generally the techniques of choice. Software hazard analysis, common cause analysis, and/or sneak circuit analysis may also be appropriate. 

SHOLIS (Chapman, 2000) is a software-based system that advises ship s crew on the safety of helicopter operations under various scenarios. The software was developed in accordance with DEF STAN 00-55 (Issue 2). A software hazard analysis was performed and on this basis certain parts of the software were designated as safety-critical. Safety critical software was formally specified using Z, developed in Spark Ada, and a partial correctness performed of the code against the specification. Information Flow analysis was used to demonstrate functional separation of critical and non-critical software. Freedom from run-time exceptions was demonstrated for all code. Static analysis of I/O usage, memory and timing was used to show separation of non-functional properties. Finally, proof that the system s top-level safety properties were maintained by the software was carried out. 

For critical packages, potential risks will be included in software risk analysis and the coverage matrix will link some specific test cases with specific third party software features they exercise. 

Three nonsafety tools are used in safety analysis failure modes, effects, and criticality analysis (FMECA) human factors analysis and software analysis. Because these techniques are extremely helpful in finding eqnipment failures, human errors, and software mistakes, safety engineers have coupled them to their safety analyses. It is definitely worthwhile to understand how these tools can benefit you. 

Top-level systems hazards analysis A system-level software safety analysis is conducted at this level. Safety-critical software is identified. Each software functional module is evaluated for hazards. 

Software safety requirements analysis The two primary tools for software safety requirements analysis are flow-down analysis and criticality analysis. Flow-down analysis does precisely verify that the proper safety requirements have been communicated to all appropriate parties and that they are correct, consistent, and complete. Checklists and cross-references are frequently used. Europe uses a mathematical modeling tool called/oma/ methods. It is used to specify and model the behavior of a system so that system specifications can be developed. 

Requirements criticality analysis is used to identify program requirements that affect safety. This is where safety-critical subsystems are often first determined. All items listed as safety-critical are then tracked through the entire software development process. 

Architectural design analysis Once the requirements phase has been completed, the software team passes on to the top-level systems design. As the design is laid out, the criticality analysis tracking system is updated with the new, more detailed information. This is performed primarily through software hazard analysis. Another tool is software FMEA. 

Sneak circuit analysis is usually performed with complex computer codes and is very expensive. It only becomes cost-effective on subsystems that are safety critical, such as an aircraft control system. Obviously, sneak circuit analysis should be teamed with the software safety analysis tools discussed in Chapter 8. This is a very powerful combination, but not cheap, certainly, very important for the most safety-critical circuits of very high-risk systems. 

Fault trees, failure modes and effects analysis (FMEA), failure modes effects and criticality analysis (FMECA) and event trees use logic, reliability data (component failure rates), and assessed system failure rates, combined with human error failure rates (using methodologies such as HEART or THERP) and other methodologies such as software reliability assessment, to develop estimates of system failure frequencies, and hence plant accident frequencies. 

Borger, E. (2012, July). Approaches to modeling business processes A critical analysis of BPMN, workflow patterns and YAWL. Software and Systems Modeling (SoSyM) 77(3), 305-318. 

One important point is doing the Software Safety Analysis as part of the overall System Safety Assessment, and not as an independent task. During the FHA critical system functions and system hazards are identified and subsequently broken down to the hardware and software level. Based on the software architecture, potential software faults which might contribute to the system hazards are detected during the Software Safety Analysis. The results of the Software Safety Analysis must be considered at the system level as well. Thus, the Software Safety Analysis is an integrated element of the System Safety Assessment. 

This consortium brings together the extensive experience of AEA Technology SRD in the use of software dependability analysis and dependent failures, the industrial experience of GEC Avionics in the development of high integrity and safety critical avionics systems and the experience of the Royal Holloway and Bedford New College in the state of the art formal methods research. 

Software safety analysis is another area where further study is required. In recent years, advances in computer technology have been increasingly used to fulfil control tasks to reduce human error and to provide operators with a better working environment in ships. This has resulted in the development of more and more software intensive systems. However, the utilisation of software in control system has introduced new failure modes and created problems in the development of safety-critical systems. The DCR-1996 has dealt with this issue in the UK offshore industry. In formal ship safety assessment, every safety-eritical system also needs to be investigated to make sure that it is impossible or extremely unlikely that its behaviour will lead to a catastrophic failure of the system and also to provide evidence for both the developers and the assessment authorities that the risk associated with the software is acceptable within the overall system risks (Wang (1997)). 

The choice of variables remaining with the operator, as stated before, is restricted and is usually confined to the selection of the phase system. Preliminary experiments must be carried out to identify the best phase system to be used for the particular analysis under consideration. The best phase system will be that which provides the greatest separation ratio for the critical pair of solutes and, at the same time, ensures a minimum value for the capacity factor of the last eluted solute. Unfortunately, at this time, theories that predict the optimum solvent system that will effect a particular separation are largely empirical and those that are available can be very approximate, to say the least. Nevertheless, there are commercially available experimental routines that help in the selection of the best phase system for LC analyses, the results from which can be evaluated by supporting computer software. The program may then suggest further routines based on the initial results and, by an iterative procedure, eventually provides an optimum phase system as defined by the computer software. 

It is critically important to capture biological assay data and allow the medicinal chemist to access the information for SAR analysis. Many software systems have been developed for this purpose, and we briefly describe two of them below. 

---