Search

It is important to sufficiently guarantee an automotive system's safety, because otherwise terrible consequences may happen. Generally the safety in an automotive system includes two aspects: reliability and timeliness. Previous studies have proposed many approaches to how to improve them. However, few of them consider the development cost along with their improvement. In this study, we aim to propose a method that can build a safety-guaranteed and development cost-minimized schedule for functionality modeled as a directed acyclic graph running on an automotive system. Unlike previous studies that tightly couple the development cost minimization with other requirements together, we start by building a schedule with the minimum development cost by ignoring safety requirement. Then, reliability and real-time requirements are subsequently taken into consideration. Together with automotive safety integrity level decomposition options provided by International Standard called ISO 26262, the decomposition is evaluated for each task to improve its safety, and tasks are then successively chosen to adjust the schedule, such that its safety can be maximized with incurring the least extra development cost. This procedure continues until a schedule that meets safety requirement is built. Experiments on a real-life automotive benchmark and extensive synthetic functionality demonstrate that our proposed heuristics outperform the state-of-the-art heuristic algorithm, and a typical intelligent optimization algorithm.

The spread of connected vehicles is expected to multiply the effects of the growing penetration of cyberspace in our life, and with this it remarkably influences the vulnerability of society to cyberattacks in an unfavorable way. Accordingly, ZalalZone - the Hungarian test track - has set up a working group to support the necessary methodological background for cybersecurity-related validation processes for the automotive industry. Therefore the paper aims to reconsider safety integrity levels in the automotive industry related to the field of cybersecurity. Following this, the article provides a comprehensive structure of integrity levels that serves the safety requirements of nowadays new cybersecurity challenges. To adapt the new cybersecurity integrity level architecture to the conventional automotive safety integrity level framework, the authors have verified a specific clustering model. To validate the aggregated probability of the possible cyberattack alternatives, the generated new cybersecurity rating scale is compared with the ASIL probability values by applying the Kolmogorov-Smirnov test. In the final step of the analysis, the possible practical application of the new framework is presented based on the identification of the derived probability value in the case of the investigated failure mode.

This article proposes an automotive safety integrity level (ASIL) D, which is the highest automotive integrity level specified in ISO 26262, and a target application processor for driving automation systems with a high convolutional neural network (CNN) processing performance of 60.4 trillion operations per second (TOPS) with high power efficiency of 13.8 TOPS/W. To achieve both performance and power efficiency, a stream processing architecture specialized for CNN hardware module is adopted to implement many low-power arithmetic units. In addition, 6 MB of local memories are implemented to reduce data transfers between dynamic random access memory (DRAM) and the CNN hardware, thereby improving the execution efficiency of the arithmetic units and saving power consumption caused by the data transfer. In order to support high safety integrity level with power efficiency, we provide safety mechanisms with high failure detection rates only for the hardware used in applications that require ASIL D support. The configuration of two CNN modules can switch between lockstep and single operation depending on the use case, thus achieving a tradeoff between performance and ASIL while maintaining power efficiency. In addition, the freedom from interference (FFI) concept defined in ISO 26262 is achieved by providing mechanisms to prevent low safety level tasks from interfering with high safety level tasks running concurrently inside the processor.

In today's automotive ICs, online safety checking is often required in order to achieve a high Automotive Safety Integrity Level (ASIL). For a Delay-Locked Loop (DLL), the most important safety (or health) indicator is the “phase error between the input clock signal and the output clock signal”. In this paper, we present a phase error monitoring scheme for DLLs, using circuits made of only standard cells. The proposed scheme can monitor the phase error continuously to record its worst-case values during a designated monitoring session. As a result, hazardous phase error glitches can be exposed and an alarm can be raised. We have implemented this monitoring scheme for a Delay Lock Loop in a 90 nm CMOS process and post-layout simulation is conducted to verify its effectiveness. Experimental results show that it can help expose hazards induced by dynamic power glitches that occurs within 1ns.

Automotive cyber-physical systems (ACPS) are typical cyber-physical systems because of the joint interaction between the cyber part and physical part. Functional safety requirement (including response time and reliability requirements) for an ACPS function must be assured for safe driving. Auto industry is cost-sensitive, power-sensitive, and environment-friendly. Energy consumption affects the development efficiency of the ACPS and the living environment of people. This paper solves the problem of optimizing the energy consumption for an ACPS function while assuring its functional safety requirement (i.e., energy-efficient functional safety for ACPS). However, implementing minimum response time, maximum reliability, and minimum energy consumption is a conflicting problem. Consequently, solving the problem is a challenge. In this paper, we propose a three-stage design process toward energy-efficient functional safety for ACPS. The topic problem is divided into three sub-problems, namely, response time requirement verification (first stage), functional safety requirement verification (second stage), and functional safety-critical energy consumption optimization (third stage). The proposed energy-efficient functional safety design methodology is implemented by using automotive safety integrity level decomposition, which is defined in the ACPS functional safety standard ISO 26262. Experiments with real-life and synthetic ACPS functions reveal the advantages of the proposed design methodology toward energy-efficient functional safety for ACPS compared with state-of-the-art algorithms.

ISO 26262 is a functional safety standard specifically made for automotive systems, in which the automotive safety integrity level (ASIL) is the representation of the criticality level. Recently, most studies have used ASIL decomposition to reduce the development cost of automotive functions. However, these studies have not paid special attention to the problem that the reliability goal may not be satisfied when ASIL decomposition is performed. In this study, we solve the problem of minimizing the development cost of a distributed automotive function while satisfying its reliability goal during the design phase by presenting two heuristic algorithms, reliabilitycalculation of scheme (RCS) and minimizing development cost with reliability goal (MDCRG). We first use RCS to calculate the reliability value of each ASIL decomposition scheme; then, the MDCRG is used to select the scheme with the minimum development cost while satisfying the reliability goal. Real-life benchmark and simulated functions based on real parameter values are used in experiments, and results show the effectiveness of the proposed algorithms.

Future generations of automobiles (also known as cybercars) will further increase the proliferation of electronic control units (ECUs) to contrive novel infotainment and distributed control applications. International Organization for Standardization (ISO) 26262 is an automotive standard that designates automotive safety integrity levels (ASILs) to indicate the criticality associated with a function. This article aims to provide a concise discussion on the safety assessment and design of dependable cybercars considering the current state of the art and future perspectives. I will elaborate on the risk assessment and design of dependable cybercars as stipulated in ISO 26262 and classify failure modes in cybercars and the methods to assess these failures. I will also discuss various hardware architectural metrics to assess safety and dependability of a cybercar design as well as various research challenges and future research directions for realizing safe and dependable cybercars.

It is getting mandatory to comply with ISO26262 in the recent automotive development. The implementation of safety mechanism to detect faults is one of the keys in ISO26262. The fault prediction will make the automotive system more reliable. The SoC in this paper introduces two features: hardware built-in self-test (BIST) for safety mechanism supporting automotive safety integrity level (ASIL) B and killer-droop monitor for fault prediction. In addition, time slicing is introduced to the testing with hardware BIST during runtime so that each test session can be shorter than the required interrupt response time in the application. The killer-droop monitor can predict the voltage droop and stop the clock supply for a certain period of time to mitigate the droop for preventing delay faults on the SoC. The monitor samples the voltage based on time-to-digital converter at CPU operation clock and predicts the voltage from the history of sampled voltage. With that prediction feature, the minimum operation voltage can be improved by 50 mV at 2.02 GHz CPU operation, and the maximum frequency can be improved by 140 MHz under 0.82 V power supply in 16 nm process.

ISO 26262, an automotive functional safety standard, ensures the functional safety of automotive systems by providing requirements and processes to govern the software lifecycle. Each functional system must be classified in terms of safety goals, risks, and automotive safety integrity level (ASIL: A, B, C, and D), with ASIL D, denoting the most stringent safety level. As the risk of the system increases, the ASIL level increases, and the standard highly recommends more stringent methods to ensure safety. ISO 26262 highly recommends that ASIL C and D-classified systems utilize semiformal and formal verification among other techniques to verify software unit design and implementation. In this paper, we compare industrial design verification steps of WatchDog Manager in an effort to be ASIL B-compliant with a proposed nondisruptive methodology to semiformally verify WatchDog Manager UML design via an automated formal framework backbone. This semiformal verification framework will allow automotive software to comply with ASILs C and D formal and semiformal unit design and implementation verification recommended guidelines in ISO 26262. Semiformal UML finite-state machines are automatically compiled into formal notations based on the Symbolic Analysis Laboratory formal notation. We capture requirements in the UML design and compile them automatically into theorems. Model checkers are run against the compiled formal model and theorems to detect counterexamples that violate the requirements in the UML model. We show that semi-formal verification of the design allows us to uncover issues that were detected in testing and production stages of ASIL B-compliant Watchdog Manager existing implementation.

For software-related companies to deliver safe products and to cope with emerging product liability risks, significant improvements to technology and processes are necessary. This column presents industry experiences in adapting product development to conform to safety standards.

ISO 26262, a functional-safety standard, uses Automotive Safety Integrity Levels (ASILs) to assign safety requirements to automotive-system elements. System designers initially assign ASILs to system-level hazards and then allocate them to elements of the refined system architecture. Through ASIL decomposition, designers can divide a function's safety requirements among multiple components. However, in practice, manual ASIL decomposition is difficult and produces varying results. To overcome this problem, a new tool automates ASIL allocation and decomposition. It supports the system and software engineering life cycle by enabling users to efficiently allocate safety requirements regarding systematic failures in the design of critical embedded computer systems. The tool is applicable to industries with a similar concept of safety integrity levels.

An integrity level defines a required level of confidence that a system satisfies critical properties related to relevant risk criteria. However, integrity level terms and definitions differ across industry sectors, and this hampers a common understanding and application of integrity levels.