Provide a concise bullet list
of CBCS requirements. Details are not needed or desired at this time
Here is a concise bullet list
of the CBCS safety requirements outlined in SSP-50038B:
- System-Level Safety Requirements:
- Control hazardous functions where
inadvertent activation/deactivation could lead to critical or
catastrophic hazards.
- General Requirements:
- Safely initialize to a known safe state.
- Perform orderly shutdown to a safe state
on command or anomaly detection.
- Operate safely during power anomalies or
safely terminate operation.
- Require multiple independent operator
actions for critical overrides.
- Reject commands that violate sequence or
prerequisites.
- Detect and recover from memory
modifications or system anomalies.
- Ensure all flight software is traceable
and documented.
- "Must Work" Function
Requirements:
- Tolerate no combination of two failures
or operator actions causing catastrophic hazards.
- Ensure redundancy and alternate
functional paths.
- Provide fault tolerance with independent
control paths for critical functions.
- "Must Not Work" Function
Requirements:
- Ensure prerequisite checks for hazardous
command execution.
- Use unique and independent commands for
inhibit removal.
- Monitor inhibit and software states with
operator feedback.
- Prevent common-cause failures by
separating control paths.
- Fault Tolerance and Recovery:
- Recover or safe critical functions
automatically within required timeframes.
- Use independent methods for
safety-critical controls.
- Operator Interaction:
- Limit operator error through robust
checks and multiple verification points.
- Provide clear notifications for
anomalies, actions, and safing states.
- Verification and Validation:
- Comprehensive analysis, testing, and
documentation for all safety-related functionalities.
- Continuous monitoring of status, failure,
and hazard data.
Let me know if you need
further details on any specific area!
Redo this, not summarized, but
using the label for each requirement
Here is a labeled bullet list
based on the requirements as structured in SSP-50038B:
System Level CBCS Safety
Requirements
- 3.1: A CBCS shall control
hazardous functions where inadvertent activation or deactivation could
result in critical or catastrophic hazards.
General CBCS Requirements
- 3.1.1.1: Safely
initialize to a known, safe state.
- 3.1.1.2: Perform an
orderly shutdown of a function to a known, safe state upon receipt of a
termination command or detection of a termination condition.
- 3.1.1.3: Processors shall
continue to operate safely during off-nominal power conditions or include
design features to safe the processor.
- 3.1.1.4: Overrides shall
require at least two independent actions by the operator.
- 3.1.1.5: Reject commands
received out of sequence where executing them could cause a hazard.
- 3.1.1.6: Detect and
recover from inadvertent memory modification during use.
- 3.1.1.7: Recover to a
known safe state upon detection of an anomaly within the CBCS.
- 3.1.1.8: Discriminate
between valid and invalid external inputs, recovering to a safe state in
case of invalid input.
- 3.1.1.9: Ensure all
flight software is traceable to a system or software requirement.
- 3.1.1.10: Document all
code.
- 3.1.1.11: Perform
integrity checks for data or commands exchanged across transmission or
reception lines.
- 3.1.1.12: Provide privacy
for uplink audio communications and protection against unauthorized uplink
commands.
- 3.1.1.13: Reject hazardous
commands that fail prerequisite checks.
CBCS "Must Work"
Function Requirements
- 3.1.2.1: Fault Tolerant
Approach:
- 3.1.2.1.1:
Provide two independent and unique command messages for deactivation of a
capability if its loss could result in a catastrophic hazard.
- 3.1.2.1.2:
Provide two independent and unique command messages for deactivation if
its loss could result in a critical hazard.
- 3.1.2.1.3:
Require at least one independent operator action for each
operator-initiated command message used for shutdown.
- 3.1.2.1.4:
Provide a non-identical method for commanding safety-critical functions
if software provides the sole control.
- 3.1.2.1.5:
Ensure alternate or redundant functional paths are separate or protected
to prevent loss from a single credible event.
- 3.1.2.1.6:
Automatically recover or safe hazardous functions within specified
timeframes to prevent catastrophic or critical hazards.
CBCS "Must Not Work"
Function Requirements
- 3.1.3.1: Fault
Containment Approach:
- 3.1.3.1.1:
Perform prerequisite checks before executing hazardous commands.
- 3.1.3.1.2:
Require unique command messages to enable inhibit removal.
- 3.1.3.1.3:
Ensure command messages for inhibit state changes are unique for each
inhibit.
- 3.1.3.1.4:
Make inhibit status available to crew and ground operators.
- 3.1.3.1.5:
Include functionally independent parameters to verify commands issued by
automated sequences.
- 3.1.3.1.6:
Ensure operator-controllable parameters are checked before execution of
hazardous commands initiated by automated sequences.
- 3.1.3.1.7:
Require at least one independent operator action for commands removing an
inhibit controlling a hazard.
- 3.1.3.1.8:
Provide software inhibit status to the crew or ground operators.
- 3.1.3.1.9:
Provide necessary data for manual system safing
to the crew or operators.
- 3.1.3.1.10:
Ensure a processor does not independently control multiple inhibits to a
hazard.
- 3.1.3.2: Control Path
Separation Approach:
- 3.1.3.2.1:
Provide inhibit status for catastrophic or critical hazards to operators.
- 3.1.3.2.2:
Use a separate control path (SCP) for each inhibit controlling a hazard.
- 3.1.3.2.3:
Ensure unique command messages are required to change the inhibit state.
- 3.1.3.2.4:
Include a functionally independent parameter in SCP checks initiated by
automated sequences.
- 3.1.3.2.5:
Ensure at least one functionally independent parameter checked by SCPs is
operator-controllable.
- 3.1.3.2.6:
Require independent operator action for commands removing a
hazard-controlling inhibit.
- 3.1.3.2.7:
Use SCPs with different functionalities for each hazard control inhibit.
- 3.1.3.2.8:
Provide software inhibit status to the operators.
- 3.1.3.2.9:
Monitor system status to detect hazardous conditions requiring automated
or operator intervention.
Let me know if further
elaboration is required on any of these requirements.
From <https://chatgpt.com/g/g-g9ereYwIw-cbcs-ssp-50038-rev-b/>