Software safety issues become important when computers are used to control real-time, safety-critical processes. This survey attempts to explain why there is a problem, what the problem is, and what is known about how to solve it. Since this is a relatively new software research area, emphasis is placed on delineating the outstanding issues and research areas.

Software safety is the subject of a research project in its initial stages at the University of California Irvine. This research deals with critical real-time software where the cost of an error is high, e.g. human life. In this paper software techniques having a bearing on safety are described and evaluated. Initial definitions of software safety concepts are presented along with some preliminary thoughts and research questions.

This report focuses on the safety analysis techniques and tools as they are applied to Automated Highway Systems (AHS). The report begins with a description of the AHS model. This is followed by a discussion of the basic features of Requirements State Machine Language (RSML) relevant to the model. The report concludes with a description of the safety analysis techniques, including forward and backward simulation, generation of fault trees, and consistency and completeness analysis..

Murphy is a set of techniques and tools under investigation for their potential in enhancing the safety of software. This paper describes some of the work which has been done and some which is planned.

The usefulness of three software fault tolerance techniques -- n-version programming, recovery blocks, and exception handling is examined within the context of real-time safety-critical environments. The general requirements of such application systems are presented and the techniques evaluated with regard to how well they satisfy these requirements.

The application of time Petri net modelling and analysis techniques to safety-critical real-time systems is explored and procedures described which allow analysis of safety, recoverability, and fault tolerance. These procedures can be used to help determine software requirements, to guide the use of fault detection and recovery procedures, to determine conditions which require immediate miti gating action to prevent accidents, etc. Thus it is possible to establish important properties duing the synthesis of the system and software design instead of using guesswork and costly a posteriori analysis.

This paper presents an approach to providing a rigorous basis for ascertaining whether or not a given set of software requirements is internally complete, i.e., closed with respect to questions and inferences that can be made on the basis of information included in the specification. Emphasis is placed on aspects of software requirements specifications that previously have not been adequately handled, including timing abstractions, safety, and robustness.

This paper presents a method for the specification, verification, and enforcement of semantic integrity using behavioral abstraction. The specification contains both the abstract invariant of the abstract object (the static characteristics of the data) and the legal operations on the objects as defined by pre and post conditions (the behavioral characteristics) which preserve this invariant. The integrity specifications can be verified by proving that the abstract operations preserve this invariant. A practical means for enforcing integrity leads naturally from this integrity specification technique.

Risk in any complex technology is unavoidable. However, important lessons can be learned from accidents which can be used to design procedures for reducing risk in the future. Although descriptions of the Therac-25 medical electron accelerator accidents have been published previously, they are incomplete and often misleading. This paper contains a detailed account of these accidents, along with some lessons that can be learned from them in terms of system engineering, software engineering, and government regulation of safety-critical systems involving software.