Functional Safety and Industry Standards

ISO 26262 is the international standard for functional safety of electrical and electronic systems in road vehicles. The second edition, published in 2018, applies to cars, trucks, buses, vocational vehicles, and motorcycles.

Each development project begins with a Hazard Analysis and Risk Assessment (HARA), which determines the Automotive Safety Integrity Level (ASIL) for safety-relevant functions. ASIL ranges from A (lowest residual risk) to D (highest residual risk), with QM (quality management only) for non-safety-relevant software.

Verification requirements scale with ASIL. At ASIL D, statement, branch, and MC/DC coverage are all required, along with bidirectional requirements traceability and structured unit testing. At lower ASIL levels, the coverage criteria and method recommendations are progressively relaxed.

DO-178C, Software Considerations in Airborne Systems and Equipment Certification, is the primary standard for approving commercial software-based aerospace systems. Published jointly by RTCA and EUROCAE, it replaced DO-178B in 2012.

DO-178C assigns Development Assurance Levels (DAL) from A (catastrophic failure consequence) to D (minor consequence). The core of the development process is a requirements-based approach with full bidirectional traceability from High-Level Requirements and Low-Level Requirements through source code, executable object code, and test cases, procedures, and results.

Level A software requires MC/DC coverage for all decisions. This is among the most demanding structural coverage requirements of any standard and is a key driver of VectorCAST's MC/DC automation capabilities.

IEC 61508 is the foundational international standard for functional safety of programmable electronic systems. It governs industrial applications including factory control systems, process automation in chemical plants, and any other safety-related programmable system not covered by a sector-specific standard.

IEC 61508 is structured in seven parts. Part 3 covers software requirements and defines the software safety lifecycle including validation and verification. The standard defines Safety Integrity Levels from SIL 1 to SIL 4. At SIL 2 and above, the use of certified tools is strongly recommended. At SIL 3 and SIL 4, it becomes effectively mandatory for practical compliance.

IEC 61508 is also the basis from which ISO 26262, EN 50716, and several other sector-specific standards are derived.

IEC 62304 governs the software lifecycle process for medical devices. It classifies software components into three safety classes: Class A (no injury or damage possible), Class B (non-serious injury possible), and Class C (serious injury or death possible).

Verification requirements scale with class. Class C software requires the most rigorous verification activities, including unit testing with structural coverage measurement and requirements traceability. Any software component that could affect patient safety must be identified, classified, and verified accordingly.

EN 50716:2023 governs software for safety-critical electronic systems in railway applications, superseding EN 50128:2011 and EN 50657:2017. It is derived from IEC 61508 and adapted to the specific requirements of railway signaling, control, protection, and rolling stock applications. Software Integrity Levels run from SIL 0 through SIL 4. MC/DC coverage is required at SIL 4.

IEC 60880:2006 covers software for computer-based instrumentation and control systems in nuclear power plants performing Category A safety functions. The standard covers requirements for all software lifecycle activities and is similar in scope to Part 3 of IEC 61508. Verification requirements include requirements-based testing, structural coverage measurement including MC/DC, and documented traceability throughout the software lifecycle.