Defensive programming is a software technique recommended by IEC 61508-3 to detect anomalous control flow, data flow, or invalid values during execution. It prevents systematic failures by ensuring every anomaly triggers a predefined safe reaction, such as discarding input, holding the last safe value, or entering a safe state. It is applied during software implementation in safety-critical domains, improving robustness and reducing residual risk.

Static resource allocation means all memory is reserved at compile-time, with no run-time allocation. In functional safety (IEC 61508, ISO 26262), this avoids unpredictable memory failures such as fragmentation, exhaustion, or overwriting. It controls systematic failures by ensuring deterministic behavior and easier verification. Used in embedded systems, PLCs, and automotive ECUs, it guarantees predictable execution but requires careful worst-case sizing to avoid overflows.

Event-driven systems with guaranteed maximum response time ensure that every safety-relevant event is processed within a proven time bound. Unlike pure time-triggered schedules, they allow fast reaction to sporadic hazards (like E-stops or sensor trips) while still offering deterministic guarantees through worst-case execution time and schedulability analysis. This controls systematic failures caused by hidden timing issues and prevents unsafe delays under load.

Time-Triggered Architecture (TTA) is a design principle for distributed real-time systems where tasks and messages run according to a globally synchronized clock and static schedule. It supports functional safety by controlling systematic failures, isolating faults, and ensuring deterministic communication with bounded latency. TTA is used in safety-critical domains like aerospace, automotive x-by-wire, and rail. Its predictable behavior reduces testing effort and simplifies certification.

Cyclic behaviour with guaranteed maximum cycle time, also known as Time-Triggered Architecture (TTA), is a deterministic scheduling method where all tasks and messages run in fixed time slots from a global clock. It supports functional safety by eliminating systematic failures from missed deadlines and jitter, and by isolating faults so corrupted data cannot propagate. Used in real-time control (e.g., braking, avionics, drive-by-wire), it provides predictable timing and easier certification. Outcome: safe, composable systems with bounded cycle times and fault-tolerant communication.

Computer-aided specification and design tools support engineers in creating clear, consistent, and complete safety requirements and designs. Used in IEC 61508 and related standards, they help control systematic failures by detecting ambiguity, contradictions, or gaps early in the lifecycle. Examples include IBM DOORS, MATLAB/Simulink, SCADE Suite, and ER/Studio. By ensuring traceability and validating models, these tools reduce errors that could otherwise compromise a safety function.

Structured diagrammatic methods are visual “thought tools” (e.g., DFDs, statecharts, Ward–Mellor) that capture requirements and designs in a logical, reviewable form. In functional safety they control systematic failures by exposing ambiguities, timing gaps, and missing safe reactions early—before code. Use them when behavior, modes, timing, and interlocks matter. Outcome: clearer specs, traceable safety reactions, and fewer costly defects.

Reusing pre-existing software in safety projects can save time, but only if its reliability is proven. IEC 61508-3 allows reuse through “trusted/verified software elements” by showing either a strong operational history (proven-in-use) or a robust body of verification evidence. This approach reduces revalidation while keeping control over systematic failures. Limits of use, configurations, and assumptions must be documented in a Safety Manual to ensure the safety function is not compromised.

Graceful degradation is a technique that preserves safety-critical functions when faults or overloads occur by intentionally shedding or simplifying non-critical services. Instead of a complete shutdown, the system enters a controlled degraded mode, ensuring alarms, interlocks, or shutdowns remain dependable. This limits the impact of systematic failures like overload or misallocation and prevents non-essential features from undermining safety. Clear priorities, deterministic transitions, and operator annunciation are key.

Diverse monitor techniques ensure safety by adding an independent checker inside the same computer as the main controller. Instead of duplicating the full control logic, the monitor applies simple rules (bounds, timing, plausibility) using a separate specification, toolchain, and timing base. If unsafe behavior is detected, it forces a safe reaction (e.g., pump shutoff). This guards against systematic failures and timing faults, giving the safety case a credible, independent safeguard without requiring a second computer.