## 3 The Safety of the Dual Architecture
### Safety Integrity against Systematic Failures  
As mentioned above, the integrity of safety against systematic failures cannot be quantified but is expressed indirectly through failure prevention and fault detection measures. Minimum lists of measures necessary for individual SILs can be found, for example, in ref. [11]. If in the dual architecture, channels A and B are mass-produced components, then the measures to prevent failures will apply to the application software because the systematic failures of the hardware and firmware of such devices are verified by their mass deployment. Failure prevention measures are applied by each manufacturer at each stage of the equipment life cycle, but mass deployment in various applications is usually an even more effective test for systematic failures. With the number of applications as well as the time of their operation, the probability that systematic failures will occur also increases. If a systematic defect is found, the manufacturer will rectify it. Therefore, it can be argued that  
Figure 1: The principle of dual architecture.  
the number of systematic failures will be inversely proportional to the number of pieces produced and the time of their operation. However, the application software is individual for almost every application, so it is necessary to focus failure prevention measures precisely on the elimination of application software errors (if we continue referring to software, we are going to assume that it is application software unless explicitly stated otherwise).  
The hardware and software of channels A and B used in the dual architecture may be identical or different. It is crucial for integrity against random failures that the channels be mutually independent. This can be carried out using appropriate hardware-level measures (galvanic channel separation, electromagnetic shielding, etc.). Only when this assumption is met does the channel comparison have the intended meaning. By suppressing the systematic failures at the application software level, the significance of the comparison depends on whether the hardware and software are identical or different. Since different hardware will also require different software, and identical hardware may or may not have identical software, this problem can be simplified to the problem of identical or different software.  
Identical software will also have identical failures, which cannot be detected by comparison. With different software, the chance of detecting systematic failures is much greater, although it cannot be quantified. The situation is shown in Figure 2. The SysA denotes the set of systematic failures of channel A, and the SysB denotes the set of systematic failures of channel B. Ideally, the intersection of these sets is an empty set. Then, by comparing the channels with each other, we would reveal any systematic failures. In the case of identical hardware and software, the SysA and SysB sets completely overlap, and the comparison does not reveal any systematic failure.  
Since the intersection of the SysA and SysB sets cannot be quantified, it must be assumed in person that the integrity of safety against systematic failures of the dual architecture will be equal to the integrity of safety against systematic failures of the worse channel (channel with a greater degree of the systematic failures).  
Therefore, it can be argued that the required SIL of the dual architecture must meet the safety integrity against systematic failures of each unit.