7

Section 4.6.3 of ISO 13849-1 concerning "safety-related application software" has following provisions:

c) Software design shall feature:

  1. semi-formal methods to describe data and control flow, e.g. state diagram or program flow chart,
  2. modular and structured programming predominantly realized by function blocks deriving from safety-related validated function block libraries,
  3. function blocks of limited size of coding,

Is there unlimited size of coding? What does "function blocks of limited size of coding" mean? I would appreciate your help with this situation.

4
  • It simply means that you should not write big functions. How big is big and how small is "limited"? Is it 40 lines? 10 lines? 120 lines? Because the standard does not specify what programming language is to be used you should use your own judgement (or more commonly your company's coding standards policy) to limit the size of functions.
    – slebetman
    Commented Nov 17, 2022 at 6:36
  • 3
    As to why a standard would specify such a specific coding practice.. it has long been observed, both anecdotally and from studies, that the longer/bigger a function is the harder it is for a human to read and understand it. Code that is hard to read have a tendency to hide bugs (make buggy logic non-obvious to the reader). Bugs affect safety.
    – slebetman
    Commented Nov 17, 2022 at 6:41
  • @slebetman - I think you're wrong pal, "function blocks" aren't just referring to splitting software into functional components when used in the context of safety-critical software Commented Nov 17, 2022 at 13:25
  • "limited size" doesn't mean "not unlimited", it means "with a reasonable limit"
    – Barmar
    Commented Nov 17, 2022 at 16:14

4 Answers 4

10

I don't have this ISO standard at hand, so my answer is based on your citation and some publicly available information (such as the table of contents).

What I found out about the standard is

  • Its title/ topic is "Safety of machinery — Safety-related parts of control systems" - so it is not specifically about software.

  • It contains only one subsection dealing with software ("4.6 Software safety requirements"), in a 86-page document with 11 chapters and several annexes.

From this context, it should be clear whatever the standard has to say about software and security must be completely programming-language agnostic and should fit all kinds of system, regardless of whether they are implemented using a high-level language like Python, a programming language like C or low-level assembler code. So it is not astonishing the paragraph you cited is very terse and abstract.

So what does "function blocks" mean in a programming-language agnostic sense? Well, any programming language I would call "sensible" provides means of functional abstraction. That means you can group a block or sequence of instructions together under a common name, with some defined input and some defined output (and maybe some side effects). This is simply the concept of a function, procedure or subroutine in most modern programming languages (usually with some related scope), but you can also organize assembly code this way.

When the standard speaks of "function blocks of limited size of coding", it simply means the function blocks in safety-related code should have "limited size". This is quite logical - for security related software, the behaviour needs to be verifiable, for example by inspections or audits, and the mental capacity of a human inspector is limited.

However, as in most such standards, it stays vague what those "limits" should be exactly. This part is something the designers of an individual system need to decide for their specific case. A function block - especially in security-related software - should never go beyond a limit where even experts have trouble to understand what it does - but where this limit is reached (or how it will be measured), is very case-dependent and language specific.

4
  • 3
    I have an old copy of the Safety Critical Systems Handbook (Smith and Simpson) which states about the 'limited size': ""Such use of subjective descriptions (e.g. the “limited size”) adds further weight to the desirability of “in-house” checklists, which can be developed in the light of experience."" Basically, experts have concluded you should figure out a useful limit among your colleagues.
    – Mast
    Commented Nov 16, 2022 at 22:40
  • As to the scope of the ISO 13849-1 (2015): a screenshot (source), official, free and legal.
    – Mast
    Commented Nov 16, 2022 at 22:45
  • Having worked in safety-critical software for years, I think you're missing the point of what they mean by "function blocks" in that industry. It's actually referring to the graphical method of designing safety software applications where functions are provided by the hardware vendor and then combined in a graphical way to form the overall application (see my answer for more details) Commented Nov 17, 2022 at 13:21
  • 1
    @ScottishTapWater: that would be a very specific and restricted meaning of the word "function block", IMHO way too restricted for this kind of standard. From the context (like the TOC here) I doubt that the cited paragraph has such a restricted point of view in mind - it looks like a general paragraph about software design to me, not like a paragraph about software design with one-and-only-one methodology.
    – Doc Brown
    Commented Nov 17, 2022 at 13:37
14

It means that you should have a standard for how many lines of code are allowed to be in a function before it has to be broken into sub-functions. It means you're not allowed to have a 10,000 line function that's just spaghetti logic.

5
  • 2
    I don't think the number of lines of code is a meaningful metric, except perhaps to say functions below some number may generally be presumed to be "small enough", while those above may be presumed to be "to big" absent an explanation for why they can't really be split. Some safety standards require support for static analysis methods that don't really work with function pointers, a function which is supposed to take a byte received from an outside device and perform one of 173 different actions based upon it might sometimes best be written as a giant switch statement.
    – supercat
    Commented Nov 17, 2022 at 15:57
  • @supercat Note that the answer says "10,000 line function that's just spaghetti logic", emphasis mine. A 173 case switch statement does not qualify as "just spaghetti logic" in my book. And yes, monsters like that are very real. I personally witnessed an offender of 7000 lines of pure spaghetti, and another one that had no less than 91 arguments to a single function. And I guess, those are the examples the authors of this standard had in mind... Commented Nov 17, 2022 at 19:14
  • @cmaster-reinstatemonica: The first sentence suggests that if a function containing 500 lines of spaghetti logic would be "too big", then a 525-line function containing a 173-item switch statement would also be too big. The second sentence suggests one thing it was intended to prohibit, but doesn't imply that only spaghetti logic would be prohibited.
    – supercat
    Commented Nov 17, 2022 at 19:19
  • @supercat Who said that the standard for how many lines of code are allowed should be irrespective of the contents of those lines? Imho, it's the failure to take the actual code structure into account that makes LOC based rules worse than useless. In your example, your giant switch is nothing better or worse than a list of 173 three line functions in a six line wrapper. Certainly not spaghetti code. Might qualify as rice code, though. Commented Nov 17, 2022 at 19:38
  • @cmaster-reinstatemonica: In general, "a standard for how many X are allowed to do Y" would imply there there is some acceptable number; if the number of X that are allowed to do Y in various circumstances would vary based upon the circumstances in questioning, the standard would be "a standard for determining how many X are allowed to to Y".
    – supercat
    Commented Nov 17, 2022 at 20:26
4

Having worked in Safety Related software engineering, and having been a TUV Certified Functional Safety Engineer, I believe I'm in a good position to answer this.

When it concerns designing software for safety critical systems, the regulations really don't like engineers being able to "just write code". When they talk about "function blocks" they don't mean a code block or a function in the way that we would normally think of. What they mean is programming the systems by combining pre-programmed (and extremely well tested) function blocks, usually in a graphical manner.

The crucial distinction is that the safety application engineers usually aren't the same people who write the underlying code of these function blocks. Usually, they're not even from the same company.

Function Block Diagram

So these "Safety Related Function Block Libraries" would usually come from the safety hardware vendor (like Schneider in the case of Triconex systems) and would contain function blocks for stuff like threshold alarming, PID control, x out of n voting, that sort of thing.

Furthermore "function blocks of limited size of coding" means that the code that underlies these individual blocks should be limited, each block should do one thing very well. You can have a block that controls the setpoint on a valve based on a couple of inputs, but you can't have a block that controls the operation of 12 valves, 3 pumps, a vessel, and alarming all at the same time.

4
  • 1
    That is surely one way of following the ISO standard's rules (and probably it is a good way), but I am sure it is not the only possible way.
    – Doc Brown
    Commented Nov 17, 2022 at 13:39
  • Nevertheless, a convoluted conglomerate of such well-tested function blocks is no better than spaghetti code. It's the complexity on each and every layer that needs to be kept to a minimum to get software with low error rates. And well-written tests that ensure that the units actually do what they are supposed to do. Because, in the end, clicking together some function blocks is programming in a graphical language. And it suffers from exactly the same problems as programming in a textual language. Commented Nov 17, 2022 at 19:29
  • 1
    @cmaster-reinstatemonica - I never said it is... It's just how it's done in the industry and what the standard is referring to Commented Nov 18, 2022 at 9:23
  • I know. I just like to remind people that it's not some technical, measurable thing that needs to be observed to get high quality software. It's the way the code is structured, and the way it is tested. I can write incomprehensible/buggy code in any language, just the same as I can write good, well-structured code in about every language (brainfuck and INTERCAL are out). Apart from those fringe languages, good code is language agnostic. But writing good code needs care and dedication. Commented Nov 18, 2022 at 14:56
3

This is a quirk of the English language. Although "limited" can be used in the sense of "restricted" in contrast with "unlimited", it is used here in the following sense:

limited

  1. ADJECTIVE [usually ADJECTIVE noun] Something that is limited is not very great in amount, range, or degree. They may only have a limited amount of time to get their points across. Shops have a very limited selection. - Collins Dictionary

The standard says that function blocks should be small.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.