Embedded Systems · Cluster
Safety-Critical Systems
Redundancy, watchdogs, and certification practice.
- 01 Deriving a Safety Integrity Level from Risk Parameters How tolerable risk, demand mode, and consequence parameters become a SIL or ASIL target, and why the resulting number constrains architecture and evidence rather than code quality.
- 02 Windowed Watchdogs and the Program-Flow Contract Why a watchdog that accepts a refresh too early is as dangerous as one that never fires, how the window and the sequence check constrain the timing, and where the supervision must live to be independent.
- 03 Safe States and Fail-Silent Behaviour in Control Systems How a safe state is chosen when no single output value is safe for every hazard, why de-energisation is the default, and what fail-silent units cost in availability.
- 04 Lockstep Cores and Comparator Logic in Safety Microcontrollers How two cores executing the same instruction stream are compared cycle by cycle, what a comparator can and cannot detect, and why the delay between the lanes is a deliberate design parameter.
- 05 Runtime Self-Tests and Diagnostic Coverage Measurement How startup and periodic self-tests establish that safety mechanisms still work, how coverage is measured by fault injection, and why a high percentage hides a distribution.
- 06 Common-Cause Failure and What Design Diversity Actually Buys Why two identical channels fail together more often than independence predicts, how beta factors enter the reliability calculation, and which kinds of diversity reduce the shared term.
- 07 Voting Redundancy and Average Probability of Failure on Demand How 1-out-of-2 and 2-out-of-3 architectures change the PFD calculation, why the common-cause term dominates the result, and what a voter must do when its channels disagree.
- 08 Time-Triggered Buses, Global Time, and Bus Guardians How a static TDMA schedule removes arbitration from the communication path, how nodes agree on a global time, and why a bus guardian is needed to enforce slot ownership.
- 09 DO-178C Objectives, Design Assurance Levels, and Structural Coverage How software level follows from failure condition severity, what the objective tables actually require at each level, and why MC/DC measures test adequacy rather than correctness.
- 10 Worst-Case Execution Time Analysis and What the Bound Is Worth Why a measured maximum is not a worst case, how static analysis bounds a path through the control-flow graph, and which microarchitectural features make the bound pessimistic or unobtainable.