Design of safety critical systems

A method of producing a system architecture including a plurality of electrical components connected to each other, the components including electronic control units, sensors and actuators, the method comprising:

• a) identifying a set of undesirable events and ascribing to each of the undesirable events an indicator of their severity;
• b) associating where possible each of the undesirable events with one or more actuators of the system architecture;
• c) developing a functional specification of an initial architecture proposed for implementation of the system architecture, the functional specification of the initial architecture including dataflow for and between electrical components thereof;
• d) refining on the functional specification fault tolerance requirements associated with the severity of each of the undesirable events and issuing refined fault tolerance requirements of the functional specification;
• e) producing replicates in the functional specification together with attached indicators of independence of the replicates, the indicators reflecting the refined fault tolerance requirements;
• f) defining a hardware structure for the system architecture;
• g) mapping the functional specification onto the hardware structure;
• and
• h) verifying automatically that the indicators of independence are preserved during the mapping.

A computer program product comprising a computer readable medium having thereon computer program code means, when the program is loaded, to make the computer execute a procedure to design and verify a system architecture, the procedure comprising:

• a) identifying a set of undesirable events and ascribing to each of the undesirable events an indicator of their severity;
• b) associating where possible each of the undesirable events with one or more actuators of the system architecture;
• c) developing a functional specification of an initial architecture proposed for implementation of the system architecture, the functional specification of the initial architecture including dataflow for and between components thereof;
• d) refining on the functional specification fault tolerance requirements associated with the severity of each of the undesirable events and issuing refined fault tolerance requirements of the functional specification;
• e) producing replicates in the functional specification together with attached indicators of independence of the replicates, the indicators reflecting the refined fault tolerance requirements;
• f) defining a hardware structure for the system architecture;
• g) mapping the functional specification onto the hardware structure;
• and
• h) verifying automatically that the indicators of independence are preserved during the mapping.

A design tool configured for design and verification of a system architecture, the system architecture including a plurality of electrical components connected to each other, the components including electronic control units, sensors, and actuators, the design tool configured to:

• a) identify a set of undesirable events and ascribe to each of the undesirable events an indicator of their severity;
• b) associate where possible each of the undesirable events with one or more actuators of the system architecture;
• c) develop a functional specification of an initial architecture proposed for implementation of the system architecture, the functional specification of the initial architecture including dataflow for and between components thereof;
• d) refine on the functional specification fault tolerance requirements associated with the severity of each of the undesirable events and issue refined fault tolerance requirements of the functional specification;
• e) produce replicates in the functional specification together with attached indicators of independence of the replicates, the indicators reflecting the refined fault tolerance requirements;
• f) define a hardware structure for the system architecture;
• g) map the functional specification onto the hardware structure;
• and
• h) verify automatically that the indicators of independence are preserved during the mapping.