A methodology is presented for the design of safety critical product lines for control automation software. The functional failure identification and propagation risk assessment method is used in the early design phase of the mechatronic system. The applied methodology starts with the decomposition of the system into functions that are connected by energy, material and signal flows. This results in a functional model that does not make any assumptions on what components are used to realize the functions. The functions are mapped to mechatronic components in a model that can be simulated: the configuration flow graph. Functional failure logic is executed in parallel to the simulation to monitor the simulation signals and to determine the health of each function. The functional health results of the simulation, when critical events are injected, are used to identify the propagation of functional failures. Alternative designs that are described with a feature model, combinations of component parameter values and changes in the critical event scenario can be simulated. System designs that result in undesirable behavior are rejected. The purpose is to identify risks and to determine mechatronic designs with adequate safety characteristics before the design process branches into software, electrical and mechanical domains. The final deliverable of the mechatronic system design phase is a feature model capturing the design alternatives with acceptable safety characteristics. The aspect of this model containing software is the starting point for software product line engineering. In control automation, programmable logic controller targets are used, so a methodology and toolchain for supporting software product line configuration for such platforms has been developed using the PLCopen standard. Two case studies are used to demonstrate the methodology: a boiling water reactor, with a focus on reactor coolant pumps, and a mobile elevating work platform
