Validation of ultrahigh dependability for software-based systems
Communications of the ACM
Software safety: where's the evidence?
SCS '01 Proceedings of the Sixth Australian workshop on Safety critical systems and software - Volume 3
What Do You Care What Other People Think?: Further Adventures of a Curious Character
What Do You Care What Other People Think?: Further Adventures of a Curious Character
Tools for traceable security verification
VoCS'08 Proceedings of the 2008 international conference on Visions of Computer Science: BCS International Academic Conference
Safety assurance: fact or fiction?
ASSC '11 Proceedings of the Australian System Safety Conference - Volume 133
Hi-index | 0.00 |
Engineers who develop safety-related systems are required to work to remarkably high standards: SIL 1, the lowest classification recognised by the international standard IEC 61508, requires a probability of failure/hour (pfh) of 10-5 or lower; and many systems are required to achieve several orders of magnitude lower failure rates than this. Yet SIL 1 is already so demanding that it is impractical to test a system for long enough to provide convincing evidence that the required failure probability has been achieved, and few systems have ever been mathematically proved to implement their specifications.Instead, safety engineers develop safety cases that argue, and seek to show, that the required pfh has been achieved.The safety authority then exercises their engineering judgement that the system will have the required safety properties. In the absence of convincing evidence, engineering judgement seems our only recourse, yet the great physicist, Richard Feynman, remarked in his book about the investigation of the accident that destroyed the Challenger space shuttle: "When I hear the words 'engineering judgement', I know they are just going to make up numbers" (Feynman, 1993).In the light of what we know, how should a professional engineer build and assure the safety of systems? Do we need different international standards and regulatory frameworks? Should there be international co-operation to develop the components and tools that could replace the proprietary, unsound and over-complex products currently available?