Software functional safety: Possibilities & limitations of IEC61508-7 Annex D

This paper explains the possibilities and limitations inherent in the approach contained in Annex D of IEC61508-7 [1] for determining the safety integrity level (SIL) of software (SW) and provides simulation results to demonstrate the necessity of uniform sampling of safety critical SW inputs - a point often overlooked in the application of the Annex D information by safety assessors. The following conclusions are reached: Proven-in-use justification via failure-free SW operating hours alone is not sufficient for SW safety certification under any circumstances. Using Annex D, it is not possible to provide safety certification for SW with a high probability of containing internal states. If the sampled SW inputs are not independent and uniformly distributed, the confidence level for a given confidence interval will likely be overestimated. The required SW input space from which samples are drawn is a subset of the entire SW input space and consists of all combinations of external values which form the inputs associated with any safety critical demand. Furthermore, the sampled SW input space may be application specific. The use of operational experience to certify SW for safety applications requires many significant assumptions that are difficult to satisfy and the records required to demonstrate satisfaction are generally not available. Consequently, statistical testing (where the SW inputs are intentionally generated to be independent and uniformly distributed) is very likely to be easier and more efficient than the use of operational experience data. Further, in some cases, exhaustive testing of the appropriate SW input space is more efficient than random "black box" testing.