[SystemSafety] Difference between software reliability and astrology

[Dewi Daniels]

Mike,

I agree with you concerning FTA.

SAE ARP4754B/EUROCAE ED-79B section 4.1.2 states, "There is no direct
correlation between Functional Development Assurance Level and numerical
probabilities", while section 5.2.3 states, "The assigned development
assurance level does not imply particular random hardware failure
probabilities". The probabilities in fault trees are random hardware
failure probabilities, design errors are mitigated using development
assurance instead. Section 4.1.2 goes on to state, "The safety objectives
associated with Failure Condition Classifications can be satisfied by both
the designated function development assurance rigor and by numerical
analysis methods (as needed). These two separate methods, in general, are
not related and complement each other".

Yours,

Dewi Daniels | Director | Software Safety Limited

Telephone +44 7968 837742 | Email dewi.daniels at software-safety.com

Software Safety Limited is a company registered in England and Wales.
Company number: 9390590. Registered office: Fairfield, 30F Bratton Road,
West Ashton, Trowbridge, United Kingdom BA14 6AZ


On Thu, 22 Aug 2024 at 09:43, M Ellims <mike at ellims.xyz> wrote:

> I'm not an expert, but I have been over this a couple of times with
> representatives from the FAA.
>
> So here goes, for what it's worth.
>
> The first thing to note is that the figure given is for
> electronic/electrical hardware and excludes software.
>
> Guidance from the FAA is the software included in any FTA analysis should
> be assigned a failure rate of zero. The rational being that software
> failure rates are in general cannot be reliably estimated and thus the
> dependence/reliance on DO178.
>
> The failure rate applies to a single aircraft of a single type, and as
> pointed out is the sum of all possible failures in a system. The first step
> is to apportion failure rates to critical systems e.g. engines, flight
> control etc. which is dependent on things such as number of engines and how
> many have to operate to either get the hull off the ground or keep it in
> the air.
>
> One of the interesting features is that some of the 3-way voting is very
> straight forward on larger aircraft - for example on control surfaces 3
> actuators are used such that any two can overpower the third. i.e. 3-way
> voting via brute force.
>
>
>
> -----Original Message-----
> From: systemsafety [mailto:
> systemsafety-bounces at lists.techfak.uni-bielefeld.de] On Behalf Of Phil
> Koopman
> Sent: 22 August 2024 00:59
> To: systemsafety at lists.techfak.uni-bielefeld.de
> Subject: Re: [SystemSafety] Difference between software reliability and
> astrology
>
> I was waiting for an aviation expert to jump in on this, but haven't
> seen it, so I will contribute some thoughts.
>
> The interpretation of 1e-9 / hr for aviation is a bit subtle.
>
> Indeed this number comes from FAA AC 25.1309-1A
>
> https://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.information/documentID/22680
>
> Page 7: "Catastrophic failures conditions must be Extremely Improbable"
>
> Page 15: "Extremely Improbable failure conditions are those having a
> probability on the order of 1 x 10-9 or less"   (1e-9)
>
> Page 14:  In the context of Qualitative Probability Terms: "Extremely
> Improbable failure conditions are those so unlikely that they are not
> anticipated to occur during the entire operational life of all airplanes
> of one type."
>
> So my takeaway is that 1e-9 applies to all aircraft OF ONE TYPE and not
> all aircraft in the fleet. Keep in mind this was written in 1988 when
> the skies were a lot less crowded.  So someone did some back of envelope
> math on flight hours per day, number of aircraft of a popular type, and
> airframe lifetime and came up with this number.
>
> Also note that this is for a "failure condition" and is not the
> acceptable failure level for the aircraft. I believe there is an
> assumption that perhaps 10 different failure conditions might all be
> possible, making the aircraft loss rate an order of magnitude worse per
> hour (but I might not be remembering the number 10 correctly -- I don't
> know if it is really written down anywhere).
>
> With modern aircraft there might be a lot more of any one type of
> aircraft, and they might fly more hours + more years. And there might be
> a lot more pieces of kit that can fail catastrophically. So this amounts
> to a legacy number that is not necessarily closely tied to current
> systems.  It might easily be a factor of 10-100 too permissive if the
> objective is to never have a failure on any aircraft of one type.
>
> That having been said, at some point the number becomes so low that it
> is likely failure conditions not anticipated in design become the long
> pole in the tent.   If I remember correctly Concorde was designed to
> 1e-10/hr and that is pretty much how things turned out.
>
> Nonetheless when combined with improved safety management system
> approaches the industry seems to have been doing pretty well when they
> don't game the safety system.
>
> Yes, the numbers for self-driving cars are challenging because of number
> of vehicles and hours. However on average a catastrophic mishap involves
> 1-2 people rather than 100-200. So that becomes an complex discussion.
> I'll note that ISO 26262 characterizes things as improbable if they are
> unlikely to happen to any single vehicle -- not the fleet of vehicles.
>
> The numbers for autonomous air taxis (1-2 person electric passenger air
> vehicles) are different, and my understanding is that they are
> controversial (some proposed numbers are more like cars than heavy jets).
>
> If any aviation experts can improve this description I welcome it,
> because this topic comes up surprisingly frequently in various
> discussions I have. And while I've done a bit of work in aviation, I
> spent most of my time on automotive.
>
> -- Phil Koopman
>
>
>
>
>
>
> On 8/21/2024 7:26 PM, Derek M Jones wrote:
> > Steve,
> >
> > Thanks for the numbers update.
> >
> >> 5 hours per day is way too low. Airplanes are very expensive,
> >> airlines are low profit margin businesses (which is why they are so
> >> interested in other, more highly profitable side business like credit
> >> cards), and airplanes only earn revenue when they are in the air.
> >
> > I was not sure whether there was a long tail of less
> > frequently used aircraft.
> >
> >> So if you double or triple your numbers below to account for 10-15
> >> flight hours per day instead of the 5 you used, you get:
> >>
> >> — 1 X 10^-5 equates to 2.5 to 3.75 Abnormal procedures per day
> >>
> >> — 1 X 10^-7 equates to one Emergency procedure or Airplane damage
> >> every 30 to 45 days
> >>
> >> — 1 X 10^-9 equates to one Catastrophic Accident every 6 to 10 years
> >
> > To me 6-10 years is not Extremely improbable.
> > Perhaps the reliability figures were chosen when there were an order
> > of magnitude fewer aircraft.
> >
> > Multiplying these values by lots of orders of magnitude implies
> > that self-driving car incidents are going to be routine.
> >
>
> --
> Phil Koopman    m: 412-260-5955    <phil.koopman at hushmail.com>
>
> _______________________________________________
> The System Safety Mailing List
> systemsafety at TechFak.Uni-Bielefeld.DE
> Manage your subscription:
> https://lists.techfak.uni-bielefeld.de/mailman/listinfo/systemsafety
>
> _______________________________________________
> The System Safety Mailing List
> systemsafety at TechFak.Uni-Bielefeld.DE
> Manage your subscription:
> https://lists.techfak.uni-bielefeld.de/mailman/listinfo/systemsafety
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.techfak.uni-bielefeld.de/pipermail/systemsafety/attachments/20240823/bf7d2912/attachment.html>