<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#0432ff" bgcolor="#feffff">
<p>Peter</p>
<p>Thamks for the clear explanation of the meaning of SIL and SC in
61508.</p>
<p>When a safety function requires a SIL 1 reliability and is
implemented using/incorporating a software component such as an
operating system, it seems that the component/OS is assigned SC 3
and assessed in the context of the use of that component by the
specific safety function. Can that assessment be partitioned so
that most of the assessment can be reused in the context of a
different safety function?</p>
<p>Martyn<br>
</p>
<div class="moz-cite-prefix">On 07/05/2025 10:50, Prof. Dr. Peter
Bernard Ladkin wrote:<br>
</div>
<blockquote type="cite"
cite="mid:5fc489ba-c52f-48b5-8e42-4d654f8a04d7@causalis.com">On
2025-05-07 10:55 , Paul Sherwood wrote:
<br>
<blockquote type="cite">.... please take a look at the Safety
Assessment Report [2], and let me know your thoughts!
<br>
<br>
[2]
<a class="moz-txt-link-freetext" href="https://marketing.codethink.co.uk/asset/20:ctrl-os-baseline-assessment">https://marketing.codethink.co.uk/asset/20:ctrl-os-baseline-assessment</a>
<br>
<br>
</blockquote>
Congratulations on progress! It looks as if you have reached a
milestone.
<br>
<br>
But I am somewhat confused by the concepts used. The baseline
assessment appears to say that CTRL OS is <suitable for
something> up to SIL 3. That <suitable for something>
doesn't occur in, for example, your message title. Neither can I
extract it from the baseline assessment. People often try to use
61508 SILs as if they were some kind of criticality level and a
statement such as "assessment for CTRL OS to SIL 3" reinforces
that impression- But SILs are not criticality levels, and this
form of words doesn't have a meaning per se without lots of other
bits being filled in.
<br>
<br>
So here is a short explanation of the concepts behind safety
requirements (= SILs on safety functions) in 61508, followed by a
request for you to say what is being claimed in terms of these
concepts.
<br>
<br>
First, pure software does not have a SIL. Safety functions have
SILs.
<br>
<br>
Second, a safety function is a function that ensures that the risk
attached to an operation O (or a collection of operations), that
would pose an unacceptable safety risk in the absence of that
safety function, is acceptable. Safety requirements in 61508 are
SILs assigned to safety functions (that verb "are" is literal).
<br>
<br>
Third, a SIL sets the required reliability of the safety function
(here, reliability in terms of the proportion of allowed
failures/the allowed failure rate). It follows that 61508 safety
requirements are reliability requirements on safety functions.
<br>
<br>
Fourth, software alone does not have a SIL because running
software alone can't result in any unsafe situation (except in the
case in which the processor on which it is running overheats,
which is dealt with, usually very effectively, by the hardware
people). The software has to be attached to some bits and pieces
which move, or heat up, or react and it is what those bits and
pieces do that is monitored and possibly controlled by a safety
function. Software is assigned a systematic capability (SC).
Software essential to executing a safety function F with SIL x is
assigned SC x.
<br>
<br>
Fifth, safety functions are not generic things; they are specific
to a safety-related system. There is no provision for assigning a
SIL to a generic operation independent of the specific system for
which that operation is acting as a safety function. There is
concomitantly no way of assigning an SC to generic software which
provides various operations of use in building software to run
safety functions.
<br>
<br>
Sixth, CRTL OS is generic software. There is no safety-related
system it is attached to (such as a chemical-reactor pressure
vessel), from which SILs for safety functions may be derived and
thus SCs inherited by the software driving those safety functions.
<br>
<br>
So, I am puzzled as to what is being asserted. I can't tell from
the baseline assessment what is being asserted. It is something
like the following.
<br>
<br>
[begin assertion]
<br>
<br>
CTRL has been assessed by exida to be suitable <for
something> to SIL 3 <without a safety function being
mentioned>
<br>
<br>
[end assertion]
<br>
<br>
Can you please tell me what is being asserted here about CTRL OS?
<br>
<br>
PBL
<br>
<br>
Prof. Dr. Peter Bernard Ladkin
<br>
Causalis Limited/Causalis IngenieurGmbH, Bielefeld, Germany
<br>
Tel: +49 (0)521 3 29 31 00
<br>
<br>
_______________________________________________
<br>
The System Safety Mailing List
<br>
<a class="moz-txt-link-abbreviated" href="mailto:systemsafety@TechFak.Uni-Bielefeld.DE">systemsafety@TechFak.Uni-Bielefeld.DE</a>
<br>
Manage your subscription:
<a class="moz-txt-link-freetext" href="https://lists.techfak.uni-bielefeld.de/mailman/listinfo/systemsafety">https://lists.techfak.uni-bielefeld.de/mailman/listinfo/systemsafety</a>
<br>
</blockquote>
</body>
</html>