Search

Safety-critical systems such as Advanced Driving Assistance Systems and Autonomous Vehicles require redundancy to satisfy their safety requirements and to be classified as fail-operational. Introducing redundancy in a system with high data rates and processing requirements also has a great impact on architectural design decisions. The current self-driving vehicle prototypes do not use a standardized system architecture but base their design on existing vehicles and the available components. In this work, we provide a novel analysis framework that allows us to qualitatively and quantitatively evaluate an in-vehicle architecture topology and compare it with others.With this framework, we evaluate different variants of two common topologies: domain and zone-based architectures. Each topology is evaluated in terms of total cost, failure probability, total communication cable length, communication load distribution, and functional load distribution.We introduce redundancy in selected parts of the systems using our automated process provided in the framework, in a safety-oriented design process that enables the ISO26262 Automotive Safety Integrity Level decomposition technique. After every design step, the architecture is re-evaluated. The advantages and disadvantages of the different architecture variants are evaluated to guide the designer towards the choice of correct architecture, with a focus on the introduction of redundancy.

The increasing use of lithium batteries and the necessary integration of battery management systems (BMS) has led international standards to demand functional safety in electromobility applications, with a special focus on electric vehicles. This work covers the complete design of an enhanced automotive BMS with functional safety from the concept phase to verification activities. Firstly, a detailed analysis of the intrinsic hazards of lithium-based batteries is performed. Secondly, a hazard and risk assessment of an automotive lithium-based battery is carried out to address the specific risks deriving from the automotive application and the safety goals to be fulfilled to keep it under control. Safety goals lead to the technical safety requirements for the next hardware design and prototyping of a BMS Slave. Finally, the failure rate of the BMS Slave is assessed to verify the compliance of the developed enhanced BMS Slave with the functional safety Automotive Safety Integrity Level (ASIL) C. This paper contributes the design methodology of a BMS complying with ISO 26262 functional safety standard requirements for automotive lithium-based batteries.

Development in the field of Single Board Computers (SBC) have been increasing for several years. They provide a good balance between computing performance and power consumption which is usually required for mobile platforms, like application in vehicles for Advanced Driver Assistance Systems (ADAS) and Autonomous Driving (AD). However, there is an ever-increasing need of more powerful and efficient SBCs which can run power intensive Deep Neural Networks (DNNs) in real-time and can also satisfy necessary functional safety requirements such as Automotive Safety Integrity Level (ASIL). ProAI is being developed by ZF mainly to run powerful and efficient applications such as multitask DNNs and on top of that it also has the required safety certification for AD. In this work, we compare and discuss state of the art SBC on the basis of power intensive multitask DNN architecture called Multitask-CenterNet with respect to performance measures such as, FPS and power efficiency. As an automotive supercomputer, ProAI delivers an excellent combination of performance and efficiency, managing nearly twice the number of FPS per watt than a modern workstation laptop and almost four times compared to the Jetson Nano. Furthermore, it was also shown that there is still power in reserve for further and more complex tasks on the ProAI, based on the CPU and GPU utilization during the benchmark., Comment: Accepted by IEEE International Conference on Computer Vision (ICCV) 2021

Automotive cyber-physical systems (ACPS) are typical cyber-physical systems because of the joint interaction between the cyber part and physical part. Functional safety requirement (including response time and reliability requirements) for an ACPS function must be assured for safe driving. Auto industry is cost-sensitive, power-sensitive, and environment-friendly. Energy consumption affects the development efficiency of the ACPS and the living environment of people. This paper solves the problem of optimizing the energy consumption for an ACPS function while assuring its functional safety requirement (i.e., energy-efficient functional safety for ACPS). However, implementing minimum response time, maximum reliability, and minimum energy consumption is a conflicting problem. Consequently, solving the problem is a challenge. In this paper, we propose a three-stage design process toward energy-efficient functional safety for ACPS. The topic problem is divided into three sub-problems, namely, response time requirement verification (first stage), functional safety requirement verification (second stage), and functional safety-critical energy consumption optimization (third stage). The proposed energy-efficient functional safety design methodology is implemented by using automotive safety integrity level decomposition, which is defined in the ACPS functional safety standard ISO 26262. Experiments with real-life and synthetic ACPS functions reveal the advantages of the proposed design methodology toward energy-efficient functional safety for ACPS compared with state-of-the-art algorithms.

Autonomous vehicles use cyber-physical systems to provide comfort and safety to passengers. Design of safety mechanisms for such systems is hindered by the growing quantity and complexity of SoCs (System-on-a-Chip) and software stacks required for autonomous operation. Our study tackles two challenges: (1) fault handling in an autonomous driving system distributed across multiple processing cores and SoCs, and (2) isolation of multiple software modules consolidated in one SoC. To address the first challenge, we extend the state-of-the-art E-Gas layered monitoring concept. Similar to E-Gas, our safety mechanism has function, controller and vehicle layers. We propose to distribute these safety layers on processors with different ASILs (Automotive Safety Integrity Level). Besides, we implement seif-test, fault injection and challenge-response protocols to detect faults at runtime in the safety mechanism itself. To facilitate distributed operation, our mechanism is built on top of the DDS (Data Distribution Service) software middleware for safety-critical embedded applications, as well as DDS-XRCE (eXtremely Resource Constrained Environment) for resource- constrained processor cores of the highest ASIL. To address the second challenge, our safety mechanism employs hardware- assisted hypervisors to isolate software modules and implement fail-silent behavior of faulty software stacks. We validate our safety mechanism on the NXP BiueBox hardware platform using the LG SVL simulator, Baidu Apollo software framework for autonomous driving, and Xen hypervisor. Our fault injection experiments demonstrate that the distributed safety mechanism successfully detects faults in an autonomous system and safely stops the vehicle when necessary.

ISO 26262 is a functional safety standard specifically made for automotive systems, in which the automotive safety integrity level (ASIL) is the representation of the criticality level. Recently, most studies have used ASIL decomposition to reduce the development cost of automotive functions. However, these studies have not paid special attention to the problem that the reliability goal may not be satisfied when ASIL decomposition is performed. In this study, we solve the problem of minimizing the development cost of a distributed automotive function while satisfying its reliability goal during the design phase by presenting two heuristic algorithms, reliabilitycalculation of scheme (RCS) and minimizing development cost with reliability goal (MDCRG). We first use RCS to calculate the reliability value of each ASIL decomposition scheme; then, the MDCRG is used to select the scheme with the minimum development cost while satisfying the reliability goal. Real-life benchmark and simulated functions based on real parameter values are used in experiments, and results show the effectiveness of the proposed algorithms.

Hazard Analysis and Risk Assessment (HARA) in various domains like automotive, aviation, and process industry suffers from the issues of validity and reliability. While there has been an increasing appreciation of this subject, there have been limited approaches to overcome these issues. In the automotive domain, HARA is influenced by the ISO 26262 international standard which details functional safety of road vehicles. While ISO 26262 was a major step towards analysing hazards and risks, like other domains, it is also plagued by the issues of reliability. In this paper, the authors discuss the automotive HARA process. While exposing the reliability challenges of the HARA process detailed by the standard, the authors present an approach to overcome the reliability issues. The approach is obtained by creating a rule-set for automotive HARA to determine the Automotive Safety Integrity Level (ASIL) by parametrizing the individual components of an automotive HARA, i.e., severity, exposure and controllability. The initial rule-set was put to test by conducting a workshop involving international functional safety experts as participants in an experiment where rules were provided for severity and controllability ratings. Based on the qualitative results of the experiments, the rule-set was re-calibrated. The proposed HARA approach by the creation of a rule-set demonstrated reduction in variation. However, the caveat lies in the fact that the rule-set needs to be exhaustive or sufficiently explained in order to avoid any degree of subjective interpretation which is a source of variation and unreliability.

ISO 26262, the new automotive functional safety standard, aims to foster the design and development of safe products by ensuring that the risks posed by hazardous components are reduced to a residual level. Therefore, the standard defines and uses the concept of Automotive Safety Integrity Levels (ASILs) that classify the strictness of safety requirements to be assigned to the failure modes of the system based on the hazard they may cause. ASIL allocation can be described as a hard optimization problem focused on finding the optimal ASIL allocation that maximizes the safety requirements and minimizes cost. However, finding this optimal allocation among a set of possible allocations can represent a difficult task in large systems that contain a large number of components, which subsequently increases the search space. In this paper, we introduce a novel approach that uses the nature-inspired meta-heuristic Ant Colony Optimization (ACO) algorithm to solve the ASIL allocation problem and makes use of strategies that reduce the solution space. The problem was formulated as a construction graph, which the ants use to construct possible ASIL allocations. The search space reduction is accelerated considerably by both the effective performance of the ACO and the convergence of the algorithm on the optimal solution. This approach has been evaluated by applying it to a hybrid braking system and a steer-by-wire system. The results show a significant improvement over genetic-based, penguins search-based and tabu search-based approaches.

The released ISO 26262 standard for automotive systems requires to create a hazard analysis and risk assessment and to create safety goals, to break down these safety goals into functional safety requirements in the functional safety concept, to specify technical safety requirements in the safety requirements specification, and to perform several validation and verification activities. Experience shows that the definition of technical safety requirements and the planning and execution of validation and verification activities has to be done jointly by OEMs and suppliers. In this paper, we present a structured and model-based safety development approach for automotive systems. The different steps are based on Jackson's requirement engineering. The elements are represented by UML notation extended with stereotypes. The UML model enables a rigorous validation of several constraints. We make use of the results of previously published work to be able to focus on the OEM/supplier interface. We illustrate our method using a three-wheeled-tilting control system (3WTC) as running example and case study.

ISO 26262, an automotive functional safety standard, ensures the functional safety of automotive systems by providing requirements and processes to govern the software lifecycle. Each functional system must be classified in terms of safety goals, risks, and automotive safety integrity level (ASIL: A, B, C, and D), with ASIL D, denoting the most stringent safety level. As the risk of the system increases, the ASIL level increases, and the standard highly recommends more stringent methods to ensure safety. ISO 26262 highly recommends that ASIL C and D-classified systems utilize semiformal and formal verification among other techniques to verify software unit design and implementation. In this paper, we compare industrial design verification steps of WatchDog Manager in an effort to be ASIL B-compliant with a proposed nondisruptive methodology to semiformally verify WatchDog Manager UML design via an automated formal framework backbone. This semiformal verification framework will allow automotive software to comply with ASILs C and D formal and semiformal unit design and implementation verification recommended guidelines in ISO 26262. Semiformal UML finite-state machines are automatically compiled into formal notations based on the Symbolic Analysis Laboratory formal notation. We capture requirements in the UML design and compile them automatically into theorems. Model checkers are run against the compiled formal model and theorems to detect counterexamples that violate the requirements in the UML model. We show that semi-formal verification of the design allows us to uncover issues that were detected in testing and production stages of ASIL B-compliant Watchdog Manager existing implementation.

The simulation of electronic control function failure has been utilized broadly as an evaluation method when determining the Automotive Safety Integrity Level (ASIL). The driver model is quite critical in the ASIL evaluation simulation. A new driver model that can consider drivers of different driving skills is proposed in this paper. It can simulate the overall performance of different drivers driving vehicles by adjusting parameters, with which the impact of a certain electronic control function failure and the ASIL are evaluated. This paper has taken the function failure of regenerative braking as the simulation object in the double-lane-change driving scenario to simulate typical driving conditions with the designed driver model, and then has obtained the ASIL of regenerative braking function, which is applied to a BAIC new energy vehicle development project.

Safety critical system development includes a wide set of techniques, methods and tools for assuring system safety. The concept of evidence is one of the key notions used to provide safety confidence to stakeholders. Safety goals must be identified during safety analysis. In addition, risks should also be considered and managed, and linked to the achievement of safety goals. This paper proposes an extension of the ISO/IEC 24744 metamodel for development methodologies in order to integrate the management of goals, risks and evidence into system development lifecycles in an ISO/IEC 15026-compliant manner that is related to the approach of assurance cases. The proposed extension is illustrated through a real-life scenario in the automotive domain where the system being developed must comply with ISO 26262, a standard in this domain. By using the proposed approach, the management of goals, risks and evidence in critical systems development is formalized and harmonized with different ISO/IEC standards, resulting in a more robust and systematic treatment of these crucial aspects., This work was partially supported by a grant from “Programa de Movilidad del Personal Investigador del Departamento de Educación, Política Lingüística y Cultura del Gobierno Vasco” (MV_2014_1_34) and funding from the FP7 programme under grant agreement number 289011 (OPENCOSS).

For safety-critical systems including railways, there has been a growing need for effective and systematic safety management processes. The outcomes of efforts in this area are international safety standards, such as IEC 61508, 62278, and ISO 26262. One of the principal activities in the safety process is hazard analysis. For this reason,considerable efforts have been directed toward methods of hazard analysis. On the other hand, the hazard analysis methods reported thus far appear to be unclear in terms of their relationship with the system design process. In addition, in some cases, the methods appear to rely heavily on information regarding the hardware and software components, the number of which is increasing. These aspects can become troublesome when design changes are necessary. To improve the situation, in this paper, hazard analysis was carried out using the result of functional analysis early in the concept development stage for a safety-critical system design. Because hazard analysis is carriedout at the system level and the result is then used to develop the safety requirements, improvements can be expectedin terms of the development time and cost when design changes are required due to changes in the requirements.As a case study, the generation of safety requirements for the development of light rail transit stations is presented.

Functional safety is related to the safety functions of a safety-related system that uses electrical/electronic/programmable (E/E/PE) devices such as sensors, logic solvers, and final elements. A legacy system is a safety-related system which offers safety functions but which was not designed to comply with the IEC 61508 standard. This paper presents a procedure for assessing the hardware safety integrity of a legacy system so as to confirm its functional safety. The procedure defines the systematic relationship between the safety function and hardware system using a function-structure map (FSM) and assesses the hardware safety integrity centered on the safety function. The proposed procedure is applied to a boiler control system of a fossil-fuel power plant.

Safety standards guide the development of systems whose operation raises concerns about safety. We focus our attention on the automotive and aerospace standards, ISO 26262 and ARP4754-A respectively. Both standards advocate a process for controlled allocation of safety integrity requirements that starts early in the design and continues as the system architecture is being refined. This procedure may generate a plethora of feasible design variants, all satisfying system safety requirement, but each having different allocations of integrity to components and different costs. In this paper, we describe a model-based safety analysis method for automating this allocation process in a way that cost-optimal design variants are selected. We show that the proposed method is generic and can satisfy both the automotive and aerospace safety standards with application to both industries. We apply the method using both standards on a common case study and discuss the differences in the results obtained, reflecting on the commonalities and differences between the two standards.

Existing automotive Hazard Analysis and Risk Assessment (HARA) process as discussed by the international standard ISO 26262 is static in nature. While the standard describes a systematic process to incorporate functional safety in the development process of Electrical & Electronic (E/E) systems, it fails to address the needs of Advanced Driver Assistance Systems (ADAS) and Automated Driving (AD) systems. In order to ensure the safety of ADAS and AD systems, it is important to incorporate the changing nature of interactions between the system and the environment, in the safety analysis process for ADAS and AD systems. In this paper, the authors argue the need for a dynamic approach for automotive safety analysis by adapting the tactical safety for ADAS and AD systems depending on the real-time operational capability and real-time ASIL (Automotive Safety Integrity Level) rating of a situation, and discuss a framework for this process. The novelty and therefore contribution of this paper lies in the proposed ASIL inspired dynamic tactical safety framework, which evaluates the severity, controllability and exposure ratings in real-time based on the real time values of the various vehicle and environment parameters. These ratings are used to assign a real-time ASIL value which is used to determine the tactical decisions in order to lower the ASIL value in real-time by altering the functional (operational) capability of the system. Furthermore, the framework is explained with the help of a case study based on a combined Adaptive Cruise Control (ACC) and Autonomous Emergency Braking (AEB) system.\ud

This paper introduces the architecture of the power supply in order to achieve the safety integrity target for power supply which is a part of safety related system. The integrity level for safety is set 4 and according to the IEC 62425 which is standard for railway application the architecture design is conducted and process for design is developed. The procedure for design consists with 6 steps. The architecture of power supply that is able to keep the safety integrity against of failure of power supply is derived through the analysis and it is suggested that the power supply adopted the result in this paper is suitable to apply in safety system. Also, the failure frequency that is a quantitative value for the power supply is proposed.

For software-related companies to deliver safe products and to cope with emerging product liability risks, significant improvements to technology and processes are necessary. This column presents industry experiences in adapting product development to conform to safety standards.

The article deals with different procedures for determining the safety integrity level and its applications. The purpose of this research was to evaluate the system and associate it with certain safety integrity level. In this article, we will use IEC 61508, IEC 61511 and IEC 62061 for comparison. The first standard is specified as the superior standard for all safety-critical systems. The second one acts as an extension of the superior standard in the field of functional safety. The last one is aimed at machinery safety.

ISO 26262 is an international standard for the functional safety of electric and electronic systems in vehicles, and this standard has become a major issue in the automotive industry. In this paper, a functional safety compliant electronic control unit (ECU) for an electric power steering (EPS) system and a demonstration purposed EPS system are developed, and a software and hardware structure for a safety critical system is presented. EPS is the most recently introduced power steering technology for vehicles, and it can improve driver’s convenience and fuel efficiency. In conformity with the design process specified in ISO 26262, the Automotive Safety Integrity Level (ASIL) of an EPS system is evaluated, and hardware and software are designed based on an asymmetric dual processing unit architecture and an external watchdog. The developed EPS system effectively demonstrates the fault detection and diagnostic functions of a functional safety compliant ECU as well as the basic EPS functions.

Functional safety of a system is the part of its overall safety that depends on the system operating correctly in response to its inputs. Safety is defined as the absence of unacceptable/unreasonable risk by functional safety standards, which enforce safety requirements in each phase of the development process of safety-critical software and hardware systems. Acceptability of risks is judged within a framework of analysis with contextual and cultural aspects by individuals who may introduce subjectivity and misconceptions in the assessment. While functional safety standards elaborate much on the avoidance of unreasonable risk in the development of safety-critical software and hardware systems, little is addressed on the issue of avoiding unreasonable judgments of risk. Through the studies of common fallacies in risk perception and ethics, we present a moral-psychological analysis of functional safety standards and propose plausible improvements of the involved risk-related decision making processes, with a focus on the notion of an acceptable residual risk. As a functional safety reference model, we use the functional safety standard ISO 26262, which addresses potential hazards caused by malfunctions of software and hardware systems within road vehicles and defines safety measures that are required to achieve an acceptable level of safety. The analysis points out the critical importance of a robust safety culture with developed countermeasures to the common fallacies in risk perception, which are not addressed by contemporary functional safety standards. We argue that functional safety standards should be complemented with the analysis of potential hazards caused by fallacies in risk perception, their countermeasures, and the requirement that residual risks must be explicated, motivated, and accompanied by a plan for their continuous reduction. This approach becomes especially important in contemporary developed autonomous vehicles with increasing computational control by increasingly intelligent software applications.

Date of Conference: 23-26 Jan. 2017 Conference name: 2017 Annual Reliability and Maintainability Symposium (RAMS) Nowadays, Safety-critical computers are extensively used in may civil domains like transportation including railways, avionics and automotive. We noticed that in design of some previous works, some critical safety design parameters like failure diagnostic coverage (DC) or common cause failure (CCF) ratio have not been seriously taken into account. Moreover, in some cases safety has not been compared with standard safety levels (IEC-61508 SIL1-SIL4) or even have not met them. Most often, it is not very clear that which part of the system is the Achilles' heel and how design can be improved to reach standard safety levels. Motivated by such design ambiguities, we aim to study the effect of various design parameters on safety in some prevalent safety configurations: 1oo2 and 2oo3. 1oo1 is also used as a reference. By employing Markov modeling, sensitivity of safety to each of the following critical design parameters is analyzed: failure rate of processing element, failure diagnostics coverage, common cause failures and repair rates. This study gives a deeper sense regarding influence of variation in design parameters over safety. Consequently, to meet appropriate safety integrity level, instead of improving some system parts blindly, it will be possible to make an informed decision on more relevant parameters. © 2017 IEEE.

To determine a proper ASIL for each hazardous event with a proper safety goal, the right classes should first be determined for the three properties of the hazardous event; (i) severity of harm from the resultant accident, (ii) exposure to the relevant operational situation, and (iii) controllability to avoid the induced risks. ASIL can be clearly determined with right classes of these three properties. But no specific methodologies or processes for their classification can be found in ISO 26262, except only a rough guideline with a simplified set of illustrative tables. In this paper, we try to present a systematic model for classifying the three properties of the hazardous event and suggest a refined procedure of ASIL determination. The proposed model provides a specific method to get a more objective ASIL compared with that in the standard. Scrutinizing the current methodology, we develop a refined method and also provide an illustrative example.

ISO 26262, a functional-safety standard, uses Automotive Safety Integrity Levels (ASILs) to assign safety requirements to automotive-system elements. System designers initially assign ASILs to system-level hazards and then allocate them to elements of the refined system architecture. Through ASIL decomposition, designers can divide a function's safety requirements among multiple components. However, in practice, manual ASIL decomposition is difficult and produces varying results. To overcome this problem, a new tool automates ASIL allocation and decomposition. It supports the system and software engineering life cycle by enabling users to efficiently allocate safety requirements regarding systematic failures in the design of critical embedded computer systems. The tool is applicable to industries with a similar concept of safety integrity levels.

To meet the growing needs from a variety of stakeholders, the development of modern systems is getting more complex and thus, the systems failure in the actual operations can potentially become more serious. This is why several international or military standards on systems safety have been published. In spite of the importance of meeting those standards such as IEC 61508 and ISO 26262 in the systems development, the associated practical methods seem deficient since those standards do not provide them. The objective of this paper is to present a method to identify potential hazards in fulfilling the requirements of the safety standards. In particular, the approach taken here is based on applying the functional analysis that covers several levels of the system under development. Note, however, that in the most of the conventional methods for hazards identification, the analysis has been focused on the failure at or underneath the component level of the system. The hazards identification method in this paper would cover the level up to the system by utilizing the functions-oriented approach. The case study of the safety enhancement for locomotive cabs is also discussed.

According to ISO 26262 (the international standard on functional safety for automotive industry), the functional safety should be considered during the whole automotive systems life cycle from the design phase throughout the production phase. In order to satisfy the standard, the automotive and related industry needs to take appropriate actions while carrying out a variety of development activities. This paper presents an approach to coping with the standard. Analyzing the standard indicates that the safety issues of the automotive systems should be handled with a system`s view whereas the conventional approach to solving the issues has been practiced with focus on the component`s level. The aforementioned system`s view implies that the functional safety shall be incorporated in the system design from both the system`s life-cycle view and the hierarchical view for the structure. In light of this, the systems engineering framework can be quite appropriate in the functional safety development and thus has been taken in this paper as a problem solving approach. Of various design issues, the analysis and verification of the safety requirements for functional safety is a key study subject of the paper. Note, in particular, that the conventional FMEA (failure mode effects analysis) and FTA (fault tree analysis) methods seem to be partly relying on the insufficient experience and knowledge of the engineers. To improve this, a systematic method is studied here and the result is applied in the design of an ABS braking system as a case study.

Besides cost issue, the charging infrastructures popularization and charging safety assurance are two major concerns for promoting electric vehicles (EVs). Several pilot-run programs, such as in the U.S., Europe, Japan, China, and Taiwan as well, enforce the safety compliance of EVs and infrastructures as an implementation policy. To be part of the players, it is essential to have the comprehensive understanding of the standard differences among IEC, SAE/UL, GB and JEVS. The way to compile the issued standards in different regions, however, is time consuming and may get limited helpful hints until tried and tested. Based on above-mentioned standards, this study summarized an overview in aspects of construction, function, performance and safety for charging equipments. To facilitate as a competent safety design, key requirements of electrical safety were presented. These crucial design rules included functional requirements, constructional requirements, personal protection against electric shock, insulation coordination, electromagnetic compatibility and charging control. The rationale and compliance requirements were highlighted to assist as design guidelines. In addition, learning from the past is always a good approach to build confidence to comply with the safety requirements. Based on the standards—follow most IEC and some SAE/UL—for pilot-run project in Taiwan, a case study of an AC charging stand provided the safety faults encountered and solutions in designing a new product that can meet safety requirements effectively. With these design guidelines and the case study, this paper provided a solid basis of safety design for electric vehicle charging equipments.

As the number, complexity and interaction of electrical, electronic and programmable electronic (E/E/PE) systems increase, a growing emphasis has been placed on the concept of functional safety during product development. IEC 61508 provides guidelines and standardized procedures in the development of reliable and dependable E/E/PE systems to assure functional safety. Determining risk classes (i.e., safety integrity levels, SILs) associated to a specific E/E/PE item may be recognized as one of the most crucial activities in the product development per IEC 61508 since SILs are used to specify necessary safety requirements for achieving an acceptable residual risk. This article presents a case study on the assessment of SILs applying failure modes, effects and diagnostic analysis (FMEDA) from which failure rates may be derived for each important failure category by combining a standard FMEA with online diagnostic techniques.

Safety is an essential issue for processes that present high risk for human beings and environment. An acceptable level of risk is obtained both with actions on the process itself (risk reduction) and with the use of special safety systems that switch the process into safe mode when a fault or an abnormal operation mode happens. These safety systems are today based on digital devices that communicate through digital networks. The IEC 61508 series specifies the safety requirements of all the devices that are involved in a safety function, including the communication network. Also electrical generation and distribution systems are processes that may have a significant level of risk, so the criteria stated by the IEC 61508 applies. Starting from this consideration, the paper analyzes the safety requirement for the communication network and compare them with the services of the communication protocol IEC 61850 that represents the most used protocol for automation of electrical plants. The goal of this job is to demonstrate that, from the technical point of view, IEC 61850 can be used for implementing safety-related functions, even if a formal safety certification is still missing.

The functional safety is applied to the public safety monitoring system. Based on optimized three-dimension risk matrix, the safety integrity level (SIL) of public safety monitoring system is studied. The research indicates that other independent layers of protection, as a supplementary, can safeguard the public safety monitoring system lacking of protection. The number of people in a public place is not considered in the optimized three-dimension risk matrix which causes the SIL derived from the three-dimension risk matrix to be rather backward-looking. So the number of independent protection layers or (and) the SIL of a safety function safety monitoring system should be decreased accordingly and make the individual risk is properly below the acceptable individual risk of the public safety. It is suggested that the functional safety of the public safety monitoring systems should be researched specially.

An integrity level defines a required level of confidence that a system satisfies critical properties related to relevant risk criteria. However, integrity level terms and definitions differ across industry sectors, and this hampers a common understanding and application of integrity levels.

ISO 26262 - The Relevance and Importance of Qualitative and Quantitative Methods for Safety and Reliability Issues Regarding the Automotive Industry Safety and reliability are key issues of today's and future automotive developments, where the involved companies have to deal with increasing functionality and complexity of software-based car functions. New functionalities cannot only be found in the area of driver assistance - most of the new car functions are and will be safety related as for example in vehicle dynamics control or active and passive safety systems. The development and integration of those functions will strengthen the need of safe processes during the system development. The new upcoming automotive standard on functional safety (ISO 26262), which is derived from the generic functional safety standard IEC 61508 to comply with the specific needs to the application sector of E/E-systems in road vehicles, will provide guidance to avoid the increasing risks from systematic faults and random hardware faults by providing feasible processes and requirements. It is evident that aspects and methods of the safety and reliability engineering are implemented and suited methods are performed in the development process at an early stage. This is one of the requirements of the new ISO 26262, which introduces a so called automotive safety lifecycle to handle all those activities that are necessary to guarantee the functional safety of automotive E/E-systems. In the following, a brief overview of the upcoming automotive standard, its new safety life cycle and the connected activities in order to ensure functional safety for safety related systems will be given. The main aim of this paper is to show the relevance and importance of one of the major tasks within the ISO 26262: the process of the hazard analysis and risk assessment as it is currently performed in the automotive industry. With the help of an example from the automotive sector, the basic steps of this method to determine the automotive safety integrity level (ASIL) are explained. Depending on the ASIL, safety requirements need to be derived as a result of the new standard regarding safety integrity attributes. Furthermore, the connection of the automotive functional safety process with methods for qualification and quantification of safety and reliability issues will be explained in this paper. The Fault Tree Analysis will be used to exemplify one of these methods which are applied subsequent to the hazard analysis and risk assessment and which make a contribution to the validation and verification of the safety process.

This paper presents control system synthesis of providing a balance between safety and control performance according to the international standard on safety, IEC 61508. As a result, the existence of a trade-off between them is established quantitatively for the first time ever.

International audience; The complexity and the criticality of automotive electronic embedded systems are steadily increasing today, and that is particularly the case for software development. The new ISO 26262 standard for functional safety is one of the answers to these challenges. The ISO 26262 defines requirements on the development process in order to ensure the safety. Among these requirements, fault injection (FI) is introduced as a dedicated technique to assess the effectiveness of safety mechanisms and demonstrate the correct implementation of the safety requirements. Our work aims at developing an approach that will help integrate FI in the whole development process in a continuous way, from system requirements to the verification and validation phase. This leads us to explore the benefits of safety analyses (Failure Mode Effects and Criticality Analysis (FMECA), Fault Tree Analysis (FTA), Critical Path Analysis (CPA) or Freedom From Interference (FFI) Analysis, etc.) for the definition of the test plan, defining efficient FI tests cases. The paper discusses the objectives and role of FI in the Verification and Validation process. It also illustrates how to apply this methodology on a platform based on AUTOSAR 4.X that integrates a trusted Front-Light Manager Application (Automotive Safety Integrity Level-ASIL B) and a non-trusted (Quality Management-QM) application. This proposed architecture allows ensuring the safety requirements with dedicated safety mechanisms and also FFI using both temporal and spatial partitioning. Finally, the results of FI test cases obtained on a mock-up running the Front-Light Manager Application, developed at Valeo GEEDS are presented.

Selected issues associated with the functional safety analysis according to the international standards IEC 61508 and IEC 61511 are presented. Determining the safety integrity level (SIL) of electric/electronic/programmable electronic (E/E/PE) safety-related systems is outlined. The importance of quantitative probabilistic modeling of these systems in verifying SIL is emphasized. Some aspects concerning the functional safety analysis of systems for detecting the combustible or toxic gases in relation to a CENELEC draft standard prEN 50402 are shortly discussed. Basic principles of methodology for the functional safety assessment of protective systems for potentially explosive atmospheres proposed in a CEN draft standard prEN 15233 are addressed.

The installation of various equipments and devices in close proximity necessitate the establishment of a design method capable of securing safety in a systematic manner. Regarding the safety index worked out for the sake of safety evaluation, including the reliability of safety devices, and the attention of operators/maintenance personnel, it is necessary to prepare the TAS (Tree Analysis for Safety) at each FA system, and though it is suitable to a system safety evaluation, it is inappropriate as a system safety functional design. In this paper, I show that the degree of surplus indicating the degree of accomplishment of the safety standard at each logical product can be defined. Using this degree of surplus, I propose the method seeking a combination of safety devices which can cope with the multiplexing of safety devices. Thus, I show that the safety functional design for FA systems can be constructed using the safety index

Electronics Throttle Control System (ETCS) is the principal electronic unit in all fuel injection engine motorbike, augmenting the engine performance efficiency in comparison to the conventional carburetor based engine. ETCS is regarded as a safety-critical component, whereby ETCS malfunction can cause unintended acceleration or deceleration event, which can be hazardous to riders. In this study, Hazard Analysis and Risk Assessment, an ISO26262 functional safety standard analysis has been applied on motorbike’s ETCS to determine the required automotive safety integrity level. Based on the analysis, the established automotive safety integrity level can help to derive technical and functional safety measures for ETCS development.

International audience; Automotive embedded systems are becoming increasingly complex. Therefore verification activities are paramount to ensure safety. ISO 26262 is the first standard specifically dedicated to automotive safety systems. This standard requires introducing fault injection (FI) from the very early phases of the development process. Our work aims at developing an approach that will help integrate FI in the whole development process in a continuous way, from system requirements to the verification and validation phase. In this paper, we concentrate on exploring the benefits of safety analyses for experimental validation of the system. We propose an analogy between FI during the pre-implementation phase with safety analyses that are of common use during system design. We finally illustrate this approach on a case study from the automotive domain.

The released ISO 26262 standard requires a hazard analysis and risk assessment for automotive systems to determine the necessary safety measures to be implemented for a certain feature. In this paper, we present a structured and model-based hazard analysis and risk assessment method for automotive systems. The hazard analysis and risk assessment are based on a requirements engineering process using problem frames. Their elements are represented by a UML notation extended with stereotypes. The UML model enables a rigorous validation of several constraints expressed in OCL. We illustrate our method using an electronic steering column lock system.

ISO 26262 - "Road vehicles-Functional Safety" is a standard for the automotive industry, administered in an attempt to prevent potential accidents due to systematic and random failures in the Electrical/Electronic-system. ISO 26262 is based on the principle of relying on safety requirements as the main source of information to enforce correctness of design. We show that the contract theory from the SPEEDS FP6 project provides a suitable foundation to structure safety requirements in ISO 26262. Contracts provide the necessary support to separate the responsibilities between a system and its environment by explicitly imposing requirements on the environment as assumptions, in order to guarantee the safety requirements. We show this by characterizing two levels of safety requirements with contracts for an industrial system where we also show how contract theory supports the verification of consistency and completeness of safety requirements.

This paper discusses the Primary Integrity Parameters (PIPs) - design attributes that, as a group, determine the level of safety integrity achieved by a Programmable Electronic System (PES). These parameters include redundancy level, failure rates and modes, diagnostic coverage factor, common cause failure rates, on-line manual test interval/duration, maintainability and security. The paper demonstrates that the level of safety provided by a PES is not simply a factor of any one of these attributes, but is determined by the total combination of the PIPs. Examples are given to show the dependency of the system safety on each of the parameters.

The automotive industry has successfully collaborated to release the ISO 26262 standard for developing safe software for cars. The standard describes in detail how to conduct hazard analysis and risk assessments to determine the necessary safety measures for each feature. However, the standard does not concern threat analysis for malicious attackers or how to select appropriate security countermeasures. We propose the application of ISO 27001 for this purpose and show how it can be applied together with ISO 26262. We show how ISO 26262 documentation can be re-used and enhanced to satisfy the analysis and documentation demands of the ISO 27001 standard. We illustrate our approach based on an electronic steering column lock system.

The publication of the ISO 26262 ("Road vehicles - Functional safety") as Draft International Standard (DIS) and its expected release as international standard in 2011 has a substantial impact on the development of automotive software. By defining the current state of technique for the development of safe automotive software, the lack of or inadequate use of these techniques has severe legal consequences. Like its ancestor, IEC 61508, as a process standard the ISO DIS 26262 defines artifacts and activities of the development process; consequently, Part 6 of the ISO standard ("Product development: Software Level") defines the artifacts and activities for requirements specification, architectural design, unit implementation and testing, as well as system integration and verification. Depending on the hazard analysis and risk assessment, and on the resulting Automotive Safety Integrity Level (ASIL) of the function under development, the standard, e.g., prescribes the use of (semi)formal methods for the verification of requirements, (semi-)formal notations for software design, the use of control and data flow analysis techniques, static and semantic code analysis, the use of test case generation, or in-the-loop verification mechanisms. Furthermore, the standard specifically acknowledges the application of model-based development in automotive software engineering. Currently, several of these rather advanced techniques are only required for higher safety integrity levels. Consequently, even though embedded software has become the leading innovation factor in automotive applications, many highly safety-critical automotive functionalities are only reluctantly implemented with software-based solutions. Here, by advancing the applicability and scalability of these advanced technologies and providing support in form of qualified tool chains, a substantial change in the development of automotive software can be achieved, allowing not only to virtualize and thus substitute physical solutions of automotive functions (e.g., X-by-wire solutions), but also to implement a new range of functionalities (e.g., autonomic driving).

The role of a safety system is to provide a safety-related function in order to monitor and maintain the safety of any equipment under its control. The safety analysis of such systems is of prime importance to avoid catastrophic consequences or even the loss of human life. In general, the various hazards that any equipment may encounter are considered without any safety functions. Later on, each hazard is studied using methods such as the risk matrix to quantify the associated risk. These methods determine which safety integrity level (SIL) needs to be implemented in order to reduce this risk to a tolerable one. Once this safety target is evaluated, an architecture is chosen during the design phase of the safety system. The standard IEC61508 states the requirements for safety systems to verify if the implemented functions reach these targets. For instance, Part 2 suggests a non-prescriptive method to merge different safety subsystems in order to achieve one with a higher SIL than those supplied by these subsystems. During the design of a SIS, the SIL selection is a very critical phase because often this system is the last line of protection against hazardous events. Even if this method is just informative, using it as a guide to follow may be an easy shortcut to label products with a dedicated safety degree. This merging method seems not to be based on an analytical method and for this reason the present paper investigates its robustness by starting from a multiphase Markovian approach. It consists in dividing the study window time of a system in phases in which a Markovian modelling is available. This method is then applied to two tudy cases given in the standard to illustrate the use of this merging method.

Safety has always been one of the most important topics of discussion within chemical, oil and gas industry organizations. Recent developments aiming to improve the safety of electrical machines used in hazardous areas include the adoption of risk assessment requirements for increased safety and non-sparking motors by the IEC 60079-7:2001/:2006 and IEC 60079-15:2005 standards. These requirements oblige manufacturers to prove their designs by testing, or to equip their products with special accessories if the risk levels exceed acceptable limits. As the risk assessment procedure requires input from both the manufacturer and end user, it also promotes collaboration in the interest of safety.

An injury arises from the transfer of potential or kinetic energy caused by the collision of a human with a hazardous object. Safety problems come from uncertainty involved in work space. As safety goes with information indicating safety of the work space, sampling and transmission of information on safety is indispensable as a means of proving safety. This paper presents 'principles of safety', describing (1) creation of safety, (2) continuity of safety, and (3) publication of safety. In order to achieve a safety (system) on the basis of the principles, this paper also explains that safety reporting means have characteristics of asymmetricalerror output signal generation and that the safety information to be reported must depend on the structure of the equipment involved. The asymmetricalerror rate is defined as a means of safety evaluation, and safety reporting means with asymmetricalerror characteristics are modeled as structures of a electric fuse and safety confirmation behavior.

ANSI/ISA-S84.01-1996 and IEC 61508 require the establishment of a safety integrity level for any safety instrumented system or safety related system used to mitigate risk. Each stage of design, operation, maintenance, and testing is judged against this safety integrity level. Quantitative techniques can be used to verify whether the safety integrity level is met. ISA-dTR84.0.02 is a technical report under development by ISA, which discusses how to apply quantitative analysis techniques to safety instrumented systems. This paper discusses two of those techniques: (1) Simplified equations and (2) Fault tree analysis.

This article focuses on the calculation of performance level (PL) by standard ISO 13849-1 Safety of machinery – Safety-related parts of control systems – Part 1: General principles for design [1]. Requirements of current standards are discussed and a typical composition of emergency stop is presented. Safety parameters of components and their determination and calculation are shown. The steps to determine the performance level for safety function of emergency stop along with a proposal to improve the reliability of existing systems are outlined. Článek je zaměřen na problematiku spojenou s výpočtem úrovně vlastností (PL) podle mezinárodní normy ISO 13849-1 Bezpečnost strojních zařízení - Bezpečnostní části ovládacích systémů - Část 1: Všeobecné zásady pro konstrukci. V článku jsou také uvedeny požadavky, které z aktuálních norem vyplývají. Dále článek popisuje způsob výpočtu a určení bezpečnostních parametrů jednotlivých komponentů. Závěr článku popisuje postup pro zvýšení spolehlivosti navrženého systému.