Safety-Critical System
Concept
Topic overview
Quick facts
- Definition of Safety-Critical System in functional safety
- Safety-Critical System in depth
- The case for Safety-Critical System
- Safety-Critical System in practice
- Where teams get Safety-Critical System wrong
- Safety-Critical System and its standards
- Industries where Safety-Critical System applies
- Ask our team about Safety-Critical System
- Terms related to Safety-Critical System
The label describes consequence, not technology: a system is safety-critical when credible failures propagate to people getting hurt.
Canonical examples span the industries: railway interlocking and train control, where a wrong-side failure can collide trains; robot safeguarding circuits, where a missed detection puts a person inside a moving machine's envelope; medical infusion pumps and radiation therapy machines, where dose errors kill quietly; aircraft flight controls and engine management; process plant emergency shutdown systems; automotive braking and steering.
In each case the harm pathway is short and the exposure is continuous, which is what separates these systems from merely important ones whose failures cost money and reputation.
The engineering consequences follow mechanically.
Criticality is assessed and expressed as an integrity level (, , PL, or a domain equivalent) assigned per function through hazard analysis, and that level then scales everything: redundancy and diagnostics in hardware, mandated techniques and coverage in software, independence of the people reviewing, verifying, and assessing the work, and the volume of documented evidence the program must produce and maintain.
Development cost per function at the higher integrity levels is routinely several times commercial-grade development, which is why competent architectures work hard to keep criticality contained.
Criticality is a spectrum and it attaches to functions, not products. A surgical robot's motion enforcement is critical while its usage analytics are not, and standards support that separation, provided the design demonstrates the non-critical parts cannot interfere with the critical ones, through mechanisms the standards call freedom from interference or independence.
Establishing that partition early is the single largest cost lever in safety-critical product development.
The case for Safety-Critical System
Whether your product contains a safety-critical function is a question with a binary commercial answer: if it does, a regulated development regime applies whose cost, timeline, and staffing you must price into the roadmap, and if you discover this late, from a customer contract, an integrator's rejection, or an incident, the retrofit typically costs multiples of doing it from concept.
Product leaders should also internalize the function-level framing, because the difference between certifying a whole product and certifying its two genuinely critical functions is often the difference between an unaffordable program and a fundable one.
Safety-Critical System in practice
Assurance path for a safety-critical system
The determination is made by hazard analysis at concept: identify what harm the system can do, in which operating situations, and derive which functions carry safety responsibility at which integrity level.
Architecture then contains the criticality: partition critical functions onto minimal, analyzable subsystems, demonstrate freedom from interference from the rest, and apply the mandated lifecycle rigor only where it is owed.
Reviewers, whether assessors, customers, or investors doing diligence, look for exactly this chain: a defensible hazard analysis, an explicit allocation of criticality to functions, and an architecture whose partitioning claims are demonstrated rather than asserted.
Where teams get Safety-Critical System wrong
Safety-Critical System and its standards
In programs run to IEC 61508, Safety-Critical System is one of the things the assessor checks first - the umbrella functional safety standard defining the safety lifecycle, sil levels, and requirements for electrical, electronic, and programmable systems.
Safety-Critical System is defined and governed by ISO 26262 - automotive functional safety standard defining asil levels and the automotive safety lifecycle.
Safety-Critical System is defined and governed by EN 50129 - safety-related electronic systems for railway signaling, including the structure of the safety case.
Failure handling strategies
| Strategy | Behavior on fault | Example |
|---|---|---|
| Fail-safe | Enter a safe state (often de-energized) | Rail signalling to red |
| Fail-operational | Continue function after fault | Fly-by-wire, steer-by-wire |
| Fail-soft | Degraded but useful operation | Limp-home engine mode |
| Fault-tolerant | Mask fault via redundancy | 2oo3 voting logic |
Industries where Safety-Critical System applies
In rail & transit, Safety-Critical System comes up in nearly every certification conversation: freight and passenger rail signaling, train control, and transit systems.
Safety-Critical System shapes how robotics & automation teams argue safety - industrial robots, cobots, amrs, and automated warehousing systems.
In autonomous systems, Safety-Critical System comes up in nearly every certification conversation: autonomous mobile equipment, off-highway autonomy, and driverless platforms.
Ask our team about Safety-Critical System
Ben TwomblyFounder & CEOLeads CSA's functional-safety, certification, and engineering programs for safety-critical products and organizations. His assessor-side background informs practical programs that connect standards, engineering work, and credible evidence.
Jeff Twombly, PEExecutive, Rail SafetyProvides executive and technical leadership for rail-safety programs, assessments, and complex transit-system work. His experience spans safety assurance, transportation-safety leadership, signaling, and independent review.
Tom CyrPrincipal Safety Engineer, IFSPSupports industrial and rail functional-safety programs with safety analysis, requirements, lifecycle planning, and certification-readiness guidance.Terms related to Safety-Critical System
How each connects to Safety-Critical System:
Functional Safety appears in the same lifecycle work as Safety-Critical System and is usually produced or reviewed alongside it.
SIL is the natural next concept after Safety-Critical System; assessors expect teams to connect the two.
Safety Case is the natural next concept after Safety-Critical System; assessors expect teams to connect the two.
ISO 26262 connects the two: Safety-Critical System and ASIL are assessed against the same lifecycle.
Both Safety-Critical System and HARA sit under ISO 26262, so evidence for one usually references the other.
Both Safety-Critical System and Safety Function sit under IEC 61508, so evidence for one usually references the other.
Safe Torque Off is governed by IEC 61508 as well, which is why the two show up together in audits.
IEC 61508 connects the two: Safety-Critical System and PFH are assessed against the same lifecycle.
FMEA is governed by IEC 61508 as well, which is why the two show up together in audits.
Both Safety-Critical System and FMEDA sit under IEC 61508, so evidence for one usually references the other.
Both Safety-Critical System and Fault Tree Analysis sit under IEC 61508, so evidence for one usually references the other.
Both Safety-Critical System and ISA sit under EN 50129, so evidence for one usually references the other.