IEEE - Aerospace and Electronic Systems - November 2019 - 64

Safety Assessment Process Optimization for Integrated Modular Avionics
Table 3.

Failure Rate of the Bottom Events
Failure Event

Failure rate 

Reference Number and Description

Data corrupted in VHF radio XRD

1.98 Â 10À4

The failure rate of VHF radio for civil
aviation [17]

Failure of a single display XDL , XDC , XDR

1.23 Â 10À4

Typical number in Fault Tree of display [18]

Failure of Avionics Full Duplex Switched
Ethernet (AFDX) network XAFDX

1 Â 10À5

MTBF of AFDX Switch in A380 is 10,000
hours [19]

Failure of General Processing Module
(GPM) XGPM

2 Â 10À5

MTBF of GPM is 50,000 hours [18]

Data corrupted inground system XGND

1 Â 10À5

Bit Error Rate for wireless communication
is between 1 Â 10À6 and 1 Â 10À5 [20]

Bit error not detected XCRC

1.53 Â 10À5

The probability of error bit escaped from
the 16 bit Cyclical Redundancy Check (CRC)

Failure of ATC partition software XATC

P ðXATCS Þ TBD

C (Design Assurance Level) software for
DO-178B/C

Failure of CMF partition software XCMF

P ðXCMF Þ TBD

C (Design Assurance Level) software for
DO-178B/C

and hardware fails. The HM function may introduce
additional complexity and bring additional issues, but
there must be an HM function within the IMA platform as part of the Onboard Maintenance System. The
ATC associated HM function could be part of the IMA
HM function.
The next step is to identify the failure rate of
partition software. Since we know the failure rate of
P ðXGPM [XATCS Þ and P ðXGPM [ XHMS Þ, and we
know that P ðXGPM \ XATCS Þ has two possible values
depending on which one is greater between P ðXGPM Þ
and P ðXATCS Þ. Another set of equations can be established as follows:

8
P ðXGPM [ XATCS Þ ¼ P ðXGPM Þ þ P ðXATCS Þ
>
>
<
À P ðXGPM \ XATCS Þ ¼ 2 Â 10À5
P ðXGPM [ XHMS Þ ¼ P ðXGPM Þ þ P ðXHMS Þ
>
>
:
À P ðXGPM \ XHMS Þ ¼ 1 Â 10À3
in which
P ðXGPM Þ ¼ 2 Â 10À5
P ðXGPM \ XATCS Þ ¼

n


P ðXGPM \ XHMS Þ ¼

P ðXGPM Þ; P ðXGPM Þ ! P ðXATCS Þ
P ðXATCS Þ; P ðXGPM Þ < P ðXATCS Þ

P ðXGPM Þ; P ðXGPM Þ ! P ðXHMS Þ
:
P ðXHMS Þ; P ðXGPM Þ < P ðXHMS Þ

The P ðXATCS Þ should be no less than P ðXGPM Þ to
ensure the safety critical function by following DO-178C
processes and meeting the goals and objectives in it. The
HM function have less safety credit requirements, so it is
free for P ðXHMS Þ to be less than P ðXGPM Þ once the top
event probability can be guaranteed.
By solving the equations set, the failure rate of partition
software is identified as the following, which is the failure
rate budget allocated to the partition software:
P ðXATCS Þ

2 Â 10À5

P ðXHMS Þ

2 Â 10À3 :

VERIFICATION OF THE SOFTWARE FAILURE RATE
Figure 8.
Updated logical diagram of datalink system.

64

In the field of aerospace engineering, the DO-178B/C
specification ensures the safety aspects of software
IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2019
IEEE - Aerospace and Electronic Systems - November 2019

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - November 2019
