6.3Functional safety and reliability

In embedded systems where a failure can directly lead to loss of life or a serious accident—medical devices, automobiles, industrial control—it is essential not only to "build it so it does not break" but to design in, from the outset, functional safety: specifying how the system should behave safely when it does fail. A systems architect must be able to judge the safety level (SIL/ASIL) appropriate to the target system's hazard, and choose a fail behavior and redundancy configuration to match.

6.3.1Functional safety standards and SIL/ASIL

• IEC61508 is the general functional-safety standard for electrical/electronic/programmable-electronic (E/E/PE) systems. It is a parent standard applied across industrial equipment in general, from which sector-specific standards for rail, process industries, automotive, and others are derived. ISO26262 is a functional-safety standard for the automotive sector, derived from IEC61508, applied to in-vehicle electronic control systems such as brakes and steering.
• SIL (Safety Integrity Level) is the safety level defined by IEC61508, with four grades, SIL1 through SIL4 (higher numbers demand greater safety). ASIL (Automotive Safety Integrity Level) is the automotive safety level defined by ISO26262, with four grades, ASIL A through D (D being the strictest), plus QM (Quality Management), which indicates no safety requirement applies. The higher the hazard of a function (e.g., brake control), the higher the SIL/ASIL required, and the more rigorous the required hardware/software verification becomes.

6.3.2FMEA and FTA

• FMEA (Failure Mode and Effects Analysis) is a bottom-up method that identifies, for each component or element, "how it could fail (its failure mode)" and evaluates how that would affect the system above it. It suits situations where you want to build up the analysis exhaustively from individual component failure modes.
• FTA (Fault Tree Analysis) is a top-down method that starts from a specific "must-not-happen accident, or top event," and expands the combinations of factors that could cause it into a tree structure using logic gates (AND/OR). It suits situations where you want to exhaustively trace the paths leading to a specific serious accident, and is used complementarily with FMEA.

6.3.3Fail-safe/fail-soft, redundancy, and PID control

• Fail-safe is a design philosophy that reliably transitions the system to a predetermined safe state when a failure occurs (e.g., a traffic light going all-red, an elevator making an emergency stop). It prioritizes reliable convergence to a safe state over continuing to function. Fail-soft is a design philosophy that continues operating with degraded functionality even after a failure (e.g., a multi-engine aircraft continuing flight after one engine fails). It suits use cases where continuity is required, but also needs a design that correctly communicates the scope of degraded function to the user.
• Redundancy provides multiple elements with the same function so the system as a whole keeps working even if some fail. Majority voting (e.g., 2-out-of-3) compares the outputs of three or more channels and adopts the majority value, a concrete redundancy implementation that prevents a single channel's error (a sensor fault, a software bug, etc.) from propagating into the result; it is used in aircraft flight-control systems and similar applications.
• PID control determines the feedback control output by combining three terms against the deviation from the target value: P (proportional), proportional to the current deviation; I (integral), based on the accumulated deviation; and D (derivative), based on the rate of change of the deviation. Using only P tends to leave a steady-state deviation (offset) from the target; adding I eliminates the steady-state deviation, but if I is too strong, combined with dead time (the delay before a control action takes effect), it tends to induce oscillation (overshoot)—D counters this by damping the rate of change to keep things balanced.

Suppose a systems architect is designing the control system for an industrial robot arm on a factory floor. First, based on IEC61508, given the magnitude of the risk that arm malfunction could lead to a collision with a worker, the architect sets a required safety level of roughly SIL2. Next, FMEA identifies failure modes for each motor, encoder, and control board driving the arm—"wire break," "abnormal sensor output," "control-program runaway," and so on—and evaluates bottom-up how each would affect the arm's motion. In parallel, FTA starts from the top event "arm collision with a worker" and traces combination factors such as "position sensor misdetection" AND "failure of the safety-fence interlock stop" in a tree structure, verifying that the design requires multiple conditions to coincide before an accident can occur. For fail-time behavior, the architect adopts a design where detecting a position-sensor anomaly immediately cuts power to the motor and stops it (fail-safe)—because a robot arm is a use case that should prioritize reliable convergence to a safe state over continued operation (continuing degraded operation via fail-soft would be inappropriate, since the arm would keep moving on faulty position data, leaving collision risk). To further ensure the position sensor itself cannot become the origin of an accident, the architect makes the position sensor redundant across three channels and determines the adopted value via 2-out-of-3 majority voting, so that a single sensor's failure does not directly cause a malfunction. Finally, PID control is used for the arm's positioning control: P control alone would leave a steady-state deviation from the target position and prevent accurate positioning, so I control is added; but making I control too strong, combined with the motor's response delay (dead time), tends to make the arm overshoot the target position and oscillate, so D control damps the response rate to converge smoothly to the position. This integrated consideration of safety design and control design together is what the practice looks like.

6.3.4Section summary

• IEC61508 (general E/E/PE) and ISO26262 (automotive) define SIL1-4 / ASIL A-D+QM, where higher numbers/letters mean stricter
• FMEA = bottom-up from components, FTA = top-down from the accident; used complementarily to analyze failure
• Fail-safe = prioritizes safe convergence, fail-soft = continues via degraded function. Redundancy/majority voting covers single failures, and PID control's I/D terms jointly manage steady-state deviation and overshoot