6.3Functional safety and reliability

In embedded systems where a failure can directly lead to loss of life or a serious accident—medical devices, automobiles, industrial control—it is essential not only to "build it so it does not break" but to design in, from the outset, functional safety: specifying how the system should behave safely when it does fail. A systems architect must be able to judge the safety level (SIL/ASIL) appropriate to the target system's hazard, and choose a fail behavior and redundancy configuration to match.

6.3.1Functional safety standards and SIL/ASIL

• IEC61508 is the general functional-safety standard for electrical/electronic/programmable-electronic (E/E/PE) systems. It is a parent standard applied across industrial equipment in general, from which sector-specific standards for rail, process industries, automotive, and others are derived. ISO26262 is a functional-safety standard for the automotive sector, derived from IEC61508, applied to in-vehicle electronic control systems such as brakes and steering.
• SIL (Safety Integrity Level) is the safety level defined by IEC61508, with four grades, SIL1 through SIL4 (higher numbers demand greater safety). ASIL (Automotive Safety Integrity Level) is the automotive safety level defined by ISO26262, with four grades, ASIL A through D (D being the strictest), plus QM (Quality Management), which indicates no safety requirement applies. The higher the hazard of a function (e.g., brake control), the higher the SIL/ASIL required, and the more rigorous the required hardware/software verification becomes.