Answer:
i. Safe Scrum →B. Iterative safety-embedded agile method
ii. Therac-25 →A. Radiation therapy machine failure
iii. Model-Driven Development → C. Code generation from verified models
ANSWER
(i) Which statement best distinguishes iterative software development methodologies from structured
methodologies?
Answer: C. Iterative methodologies allow repeated refinement through multiple development cycles
(ii) Which methodology explicitly embeds safety activities within each development sprint?
Answer: B. Safe Scrum
(iii) The primary safety failure in the Therac-25 system resulted from:
Answer: C. Inadequate software engineering and safety practices
ANSWER
(a) With the neat sketch, explain the general causes of system failure during operations.
Explanation:
System failure is rarely caused by just one factor. It is usually a combination of three general areas:
• A. User Causes (Human Factors):
Failure occurs when the people operating the system make mistakes.
o Incorrect Action/Usage: The user provides the wrong input or uses the system in a way it wasn't
designed for. (Example: In the Therac-25, operators typed too fast, triggering a hidden bug).
o Unauthorized Access: Security breaches or hacking.
• B. Hardware Causes (Physical Factors):
These are failures of the physical machine.
o Design Error: The physical parts were poorly designed for the job.
o Materials Defect: Parts break due to "wear and tear" or manufacturing flaws.
o Environmental Effects & Stress: Failure caused by extreme heat, vibration, or electricity
• C. Software Causes (Logic Factors):
Software doesn't "break" like hardware; it fails because of errors in logic.
o Misunderstanding Requirements: The programmer built the wrong thing because the
instructions were unclear
o Software Design Error: The "architecture" of the code is bad.
o Implementation Error: Coding mistakes or "bugs."
o Malware: Malicious software interfering with operations.
(b) Using the Therac-25 case study, analyse the major software engineering failures that led to
catastrophic safety incidents.
The Answer:
The Therac-25 disaster was caused by three specific software engineering failures:
▪ Lack of Independent Review:
The manufacturer (AECL) relied entirely on in-house code and did not have the software independently
reviewed by safety experts.
▪ Unsafe Reuse of Code:
The engineers reused code from older models (Therac-6 and Therac-20). The older models
had hardware interlocks (physical safety guards) that blocked software errors. The Therac-25 removed
these hardware guards, exposing the software bugs that were always there.
▪ Lack of Integrated Testing:
The software and hardware were never tested together until the machine was assembled at the hospital.
This meant they missed critical timing/race-condition errors that only happened when the real hardware
was used.
(c) Explain the V-Model and critically discuss its suitability for safety-critical software development. (5
marks)
The Answer:
The V-Model is a software development methodology that demonstrates the relationship between each phase of
the development lifecycle and its corresponding testing phase.
• Left Side (Decomposition): Represents the specification phases (Requirements →High-Level
Design →Detailed Design).
• Right Side (Integration): Represents the testing phases (Unit Testing →Integration Testing →System
Testing).
• The Link: Horizontal lines connect the left and right sides, showing that testing is planned at the same
time as the design. (e.g., System Tests are designed while writing Requirements).
Suitability for Safety-Critical Software:
The V-Model is considered highly suitable (and often the standard) for safety-critical systems because:
• Traceability: It forces a direct link between every Requirement and a specific Test. You can prove
exactly which test verifies that a safety feature works.
• Early Defect Detection: Since tests are planned early (during the design phase), potential safety hazards
in the logic are often found before any code is written.
• Strict Verification: It prevents "testing quality in" at the end. In safety systems, you cannot rely on
fixing bugs after the fact; the V-Model ensures the design is verified step-by-step.
(d) Evaluate the statement: "No one process or methodology is a silver bullet for software safety."
Support your argument with any four (4) points that a project team must review. (4 marks)
The Answer:
The statement is TRUE (Valid).
simply following a methodology (like Agile or Waterfall) does not ensure safety. A methodology manages the
workflow, but it does not automatically identify hazards or prevent bad design choices. Safety requires specific
analysis and conscious effort beyond just "following the steps."
Support Points (Items to Review):
regardless of the methodology used, a project team must specifically review these four items to determine if
hazards have been introduced:
➢ Specifications: Reviewing the initial requirements to ensure no unsafe behaviors were requested.
➢ Designs: Checking the architecture to ensure safety controls (like interlocks) are present.
➢ Implementations: Reviewing the actual code to ensure it matches the design and follows coding
standards.
➢ Problem/Failure Reports: Analyzing past errors or current bug reports to ensure that "fixes" haven't
created new safety risks.
#KesengewaFamily
Answers Based on LECTURE 3
Safety and Software Development methodologies