# Safety

**In short:** Safety is a system's ability to avoid states that endanger people, property or the environment. ISO/IEC 25010 splits it into five parts, from limiting operation to staying safe after integration.

## Explanation

Safety means the system avoids states in which human life, health, property or the environment is endangered. ISO/IEC 25010 breaks this into five sub-characteristics. The article ISO/IEC 25010 Product Quality Model covers the wider model.

**The five sub-characteristics**

- **Operational constraint:** when the system meets an operational hazard, it keeps its operation within safe parameters or states. See the article Operational Constraint.
- **Risk identification:** the system can recognize sequences of events or operations that expose life, property or the environment to unacceptable risk.
- **Fail safe:** after a failure, the system automatically enters a safe operating mode or returns to a safe condition.
- **Hazard warning:** the system warns of unacceptable risks early enough for operators or internal controls to react and keep operations safe. See the article Hazard Warning.
- **Safe integration:** the system stays safe during and after integration with other components.

**Related design ideas**

A fail-safe default makes the system fall into a known-safe state when something unexpected happens. It does not fall into an open, permissive or undefined state.

Watchdog supervision is one safety tactic. A component sends a periodic heartbeat. If the heartbeat stops, the system moves to a safe state. See the articles Heartbeat and Safety Tactic.

**Lessons from the Therac-25 analysis**

Safety is a property of the whole system, not of the software alone. Safety must be built into the software. It must also be assured at the system level, even when the software has errors.

Reusing software does not guarantee safety in a new system. In the older Therac-20, hardware interlocks limited the harm.

## Example

A hypothetical machine controller sends a heartbeat every 100 ms to a separate supervisor. If the heartbeat stops, the supervisor moves the machine to a known-safe state. The machine does not stay in whatever state it was in. This is a watchdog with a fail-safe default. The team also lists the event sequences that could harm an operator, which is risk identification.

## Trade-offs

The verified facts here do not describe trade-offs with other qualities. One point does follow from the Therac-25 lessons. Software-level safety alone is not enough. Teams also need safeguards at the system level, such as hardware interlocks, which adds design work beyond the software.

Generic paths from normal operation to a safe state.

```mermaid
flowchart TD
  A[Normal operation] -->|failure or missing heartbeat| B[Fail-safe transition]
  B --> C[Known safe state]
  A -->|risk detected| D[Hazard warning to operator]
  D --> E[Operation limited to safe parameters]
```

## Checks

- The document states which operational hazards exist and how the system limits its operation to safe parameters or states when they occur.
- The document describes the safe state the system enters or returns to after a failure.
- The document says how operators or controls get warned of unacceptable risks early enough to react.
- The document explains how safety is kept when components are integrated, including reused software.
- Safety is assured at system level, not only in software, for example with hardware safeguards.

## Related

- [Safety Tactic](https://arc.fuet.ch/concepts/tactics/safety-tactics.md)
- [Operational Constraint](https://arc.fuet.ch/concepts/quality-attributes/operational-constraint.md)
- [Hazard Warning](https://arc.fuet.ch/concepts/quality-attributes/hazard-warning.md)
- [Risk Identification and Safe Integration](https://arc.fuet.ch/concepts/quality-attributes/risk-identification.md)
- [Heartbeat](https://arc.fuet.ch/concepts/tactics/heartbeat.md)
- [ISO/IEC 25010 Product Quality Model](https://arc.fuet.ch/concepts/quality-attributes/iso-iec-25010-quality-model.md)
- [Fault Tolerance](https://arc.fuet.ch/concepts/quality-attributes/fault-tolerance.md)
- [Quality Attribute Scenario](https://arc.fuet.ch/concepts/quality-attributes/quality-attribute-scenario.md)

## Sources

- [ISO 25010](https://iso25000.com/index.php/en/iso-25000-standards/iso-25010?start=9) — iso25000.com, accessed 2026-11-09
- [Fail-Safe Defaults | arc42 Quality Model](https://quality.arc42.org/approaches/fail-safe-defaults) — quality.arc42.org, accessed 2026-11-09
- [Therac-25 - V](https://web.mit.edu/6.033/2004/wwwdocs/papers/Therac_5.html) — web.mit.edu, accessed 2026-11-09