Search

It is important to sufficiently guarantee an automotive system's safety, because otherwise terrible consequences may happen. Generally the safety in an automotive system includes two aspects: reliability and timeliness. Previous studies have proposed many approaches to how to improve them. However, few of them consider the development cost along with their improvement. In this study, we aim to propose a method that can build a safety-guaranteed and development cost-minimized schedule for functionality modeled as a directed acyclic graph running on an automotive system. Unlike previous studies that tightly couple the development cost minimization with other requirements together, we start by building a schedule with the minimum development cost by ignoring safety requirement. Then, reliability and real-time requirements are subsequently taken into consideration. Together with automotive safety integrity level decomposition options provided by International Standard called ISO 26262, the decomposition is evaluated for each task to improve its safety, and tasks are then successively chosen to adjust the schedule, such that its safety can be maximized with incurring the least extra development cost. This procedure continues until a schedule that meets safety requirement is built. Experiments on a real-life automotive benchmark and extensive synthetic functionality demonstrate that our proposed heuristics outperform the state-of-the-art heuristic algorithm, and a typical intelligent optimization algorithm.

The spread of connected vehicles is expected to multiply the effects of the growing penetration of cyberspace in our life, and with this it remarkably influences the vulnerability of society to cyberattacks in an unfavorable way. Accordingly, ZalalZone - the Hungarian test track - has set up a working group to support the necessary methodological background for cybersecurity-related validation processes for the automotive industry. Therefore the paper aims to reconsider safety integrity levels in the automotive industry related to the field of cybersecurity. Following this, the article provides a comprehensive structure of integrity levels that serves the safety requirements of nowadays new cybersecurity challenges. To adapt the new cybersecurity integrity level architecture to the conventional automotive safety integrity level framework, the authors have verified a specific clustering model. To validate the aggregated probability of the possible cyberattack alternatives, the generated new cybersecurity rating scale is compared with the ASIL probability values by applying the Kolmogorov-Smirnov test. In the final step of the analysis, the possible practical application of the new framework is presented based on the identification of the derived probability value in the case of the investigated failure mode.

This article proposes an automotive safety integrity level (ASIL) D, which is the highest automotive integrity level specified in ISO 26262, and a target application processor for driving automation systems with a high convolutional neural network (CNN) processing performance of 60.4 trillion operations per second (TOPS) with high power efficiency of 13.8 TOPS/W. To achieve both performance and power efficiency, a stream processing architecture specialized for CNN hardware module is adopted to implement many low-power arithmetic units. In addition, 6 MB of local memories are implemented to reduce data transfers between dynamic random access memory (DRAM) and the CNN hardware, thereby improving the execution efficiency of the arithmetic units and saving power consumption caused by the data transfer. In order to support high safety integrity level with power efficiency, we provide safety mechanisms with high failure detection rates only for the hardware used in applications that require ASIL D support. The configuration of two CNN modules can switch between lockstep and single operation depending on the use case, thus achieving a tradeoff between performance and ASIL while maintaining power efficiency. In addition, the freedom from interference (FFI) concept defined in ISO 26262 is achieved by providing mechanisms to prevent low safety level tasks from interfering with high safety level tasks running concurrently inside the processor.

Safety-critical systems such as Advanced Driving Assistance Systems and Autonomous Vehicles require redundancy to satisfy their safety requirements and to be classified as fail-operational. Introducing redundancy in a system with high data rates and processing requirements also has a great impact on architectural design decisions. The current self-driving vehicle prototypes do not use a standardized system architecture but base their design on existing vehicles and the available components. In this work, we provide a novel analysis framework that allows us to qualitatively and quantitatively evaluate an in-vehicle architecture topology and compare it with others.With this framework, we evaluate different variants of two common topologies: domain and zone-based architectures. Each topology is evaluated in terms of total cost, failure probability, total communication cable length, communication load distribution, and functional load distribution.We introduce redundancy in selected parts of the systems using our automated process provided in the framework, in a safety-oriented design process that enables the ISO26262 Automotive Safety Integrity Level decomposition technique. After every design step, the architecture is re-evaluated. The advantages and disadvantages of the different architecture variants are evaluated to guide the designer towards the choice of correct architecture, with a focus on the introduction of redundancy.

In today's automotive ICs, online safety checking is often required in order to achieve a high Automotive Safety Integrity Level (ASIL). For a Delay-Locked Loop (DLL), the most important safety (or health) indicator is the “phase error between the input clock signal and the output clock signal”. In this paper, we present a phase error monitoring scheme for DLLs, using circuits made of only standard cells. The proposed scheme can monitor the phase error continuously to record its worst-case values during a designated monitoring session. As a result, hazardous phase error glitches can be exposed and an alarm can be raised. We have implemented this monitoring scheme for a Delay Lock Loop in a 90 nm CMOS process and post-layout simulation is conducted to verify its effectiveness. Experimental results show that it can help expose hazards induced by dynamic power glitches that occurs within 1ns.

The present study proposes a method that numerically quantifies automotive safety integrity level (ASIL). Additionally, the method reduces the uncertainty in the risk estimation step by subdividing the ASIL step by applying fuzzy theory to reduce the ambiguity of ASIL with an extremely wide step. The conventional risk-based design concept is adopted to quantify ASIL, and fuzzy modeling is used to express the vehicle safety integrity ratings of uncertain automotive electrical equipment. To overcome the uncertainty, we fuzzify the variable using the mean expected value method and select the trapezoidal fuzzy number. The final fuzzy output is generated using Mamdani’s method with 25 fuzzy rules combined with variables to obtain risk. This theory provides a useful approach for overcoming the inherent uncertainty in ASIL. We attempt to establish the effectiveness of the proposed method by utilizing it to quantify the automatic emergency-braking device scenario, which is a typical target system.

The increasing use of lithium batteries and the necessary integration of battery management systems (BMS) has led international standards to demand functional safety in electromobility applications, with a special focus on electric vehicles. This work covers the complete design of an enhanced automotive BMS with functional safety from the concept phase to verification activities. Firstly, a detailed analysis of the intrinsic hazards of lithium-based batteries is performed. Secondly, a hazard and risk assessment of an automotive lithium-based battery is carried out to address the specific risks deriving from the automotive application and the safety goals to be fulfilled to keep it under control. Safety goals lead to the technical safety requirements for the next hardware design and prototyping of a BMS Slave. Finally, the failure rate of the BMS Slave is assessed to verify the compliance of the developed enhanced BMS Slave with the functional safety Automotive Safety Integrity Level (ASIL) C. This paper contributes the design methodology of a BMS complying with ISO 26262 functional safety standard requirements for automotive lithium-based batteries.

Development in the field of Single Board Computers (SBC) have been increasing for several years. They provide a good balance between computing performance and power consumption which is usually required for mobile platforms, like application in vehicles for Advanced Driver Assistance Systems (ADAS) and Autonomous Driving (AD). However, there is an ever-increasing need of more powerful and efficient SBCs which can run power intensive Deep Neural Networks (DNNs) in real-time and can also satisfy necessary functional safety requirements such as Automotive Safety Integrity Level (ASIL). ProAI is being developed by ZF mainly to run powerful and efficient applications such as multitask DNNs and on top of that it also has the required safety certification for AD. In this work, we compare and discuss state of the art SBC on the basis of power intensive multitask DNN architecture called Multitask-CenterNet with respect to performance measures such as, FPS and power efficiency. As an automotive supercomputer, ProAI delivers an excellent combination of performance and efficiency, managing nearly twice the number of FPS per watt than a modern workstation laptop and almost four times compared to the Jetson Nano. Furthermore, it was also shown that there is still power in reserve for further and more complex tasks on the ProAI, based on the CPU and GPU utilization during the benchmark., Comment: Accepted by IEEE International Conference on Computer Vision (ICCV) 2021

Automotive cyber-physical systems (ACPS) are typical cyber-physical systems because of the joint interaction between the cyber part and physical part. Functional safety requirement (including response time and reliability requirements) for an ACPS function must be assured for safe driving. Auto industry is cost-sensitive, power-sensitive, and environment-friendly. Energy consumption affects the development efficiency of the ACPS and the living environment of people. This paper solves the problem of optimizing the energy consumption for an ACPS function while assuring its functional safety requirement (i.e., energy-efficient functional safety for ACPS). However, implementing minimum response time, maximum reliability, and minimum energy consumption is a conflicting problem. Consequently, solving the problem is a challenge. In this paper, we propose a three-stage design process toward energy-efficient functional safety for ACPS. The topic problem is divided into three sub-problems, namely, response time requirement verification (first stage), functional safety requirement verification (second stage), and functional safety-critical energy consumption optimization (third stage). The proposed energy-efficient functional safety design methodology is implemented by using automotive safety integrity level decomposition, which is defined in the ACPS functional safety standard ISO 26262. Experiments with real-life and synthetic ACPS functions reveal the advantages of the proposed design methodology toward energy-efficient functional safety for ACPS compared with state-of-the-art algorithms.

Classical decentralized architectures based on large networks of microprocessor-based Electronic Control Units (ECU), namely those used in self-driving cars and other highly-automated applications used in the automotive industry, are becoming more and more complex. These new, high computational power demand applications are constrained by limits on energy consumption, weight, and size of the embedded components. The adoption of new embedded centralized electrical/electronic (E/E) architectures based on dynamically reconfigurable hardware represents a new possibility to tackle these challenges. However, they also raise concerns and questions about their safety. Hence, an appropriate evaluation must be performed to guarantee that safety requirements resulting from an Automotive Safety Integrity Level (ASIL) according to the standard ISO 26262 are met. In this paper, a methodology for the evaluation of dynamically reconfigurable systems based on centralized architectures is presented. The aim is to evaluate the reliability and probability of failure while exploring the design space without compromise the overall system performance. The methodology is divided into three stages. In the first stage, the system is decomposed, and its sub-systems are isolated before applying a Fault Tree Analysis on the elements of each sub-system. The mathematical stochastic model of Markov Chain is used in the second stage to obtain the reliability function and the quantification of the Mean Time to Failure (MTTF) of the system. Finally, the overall system is evaluated in terms of performance, and according to time constraints such as reconfiguration latency in case of failure. Applying this method, we quantify the MTTF in Failure in Time (FIT) format of an E/E architecture. Additionally, we evaluate each sub-system independently and obtain the respective ASIL decomposition of the overall system. The aim is to evaluate the migration of safety-related functionalities/redundancy from traditional architectures into reprogrammable devices. With the application of this methodology, we can evaluate the reliability and performance of dynamically reconfigurable systems and define new E/E automotive architectures.

Component-based approaches and software product lines have been adopted by industry to manage the diversity of configurations on safety-critical software. Safety certification demands compliance with standards. ISO 26262 standard uses the concept of Automotive Safety Integrity Level (ASIL) to allocate safety requirements to components of a system under design. Compliance with standards is demonstrated through achieving those ASILs which can be very expensive when requirements are high. While achieving safety certification of variant-intensive components without being unnecessarily stringent or expensive is desirable for economy, it poses challenges to safety engineering. In this paper, we propose an approach to manage the diversity of safety goals and supporting safety certification of software components. Our approach is built upon the integration among ASIL decomposition, software process modeling, and variability management techniques. The approach supports cost-effective safety certification and the efficient tailoring of process models to components according to their ASILs. We evaluated our approach in the automotive domain. The approach is feasible in supporting the management of the diversity of safety goals, and cost-effective safety certification of software components.

ISO 26262 is a functional safety standard specifically made for automotive systems, in which the automotive safety integrity level (ASIL) is the representation of the criticality level. Recently, most studies have used ASIL decomposition to reduce the development cost of automotive functions. However, these studies have not paid special attention to the problem that the reliability goal may not be satisfied when ASIL decomposition is performed. In this study, we solve the problem of minimizing the development cost of a distributed automotive function while satisfying its reliability goal during the design phase by presenting two heuristic algorithms, reliabilitycalculation of scheme (RCS) and minimizing development cost with reliability goal (MDCRG). We first use RCS to calculate the reliability value of each ASIL decomposition scheme; then, the MDCRG is used to select the scheme with the minimum development cost while satisfying the reliability goal. Real-life benchmark and simulated functions based on real parameter values are used in experiments, and results show the effectiveness of the proposed algorithms.

Hazard Analysis and Risk Assessment (HARA) in various domains like automotive, aviation, and process industry suffers from the issues of validity and reliability. While there has been an increasing appreciation of this subject, there have been limited approaches to overcome these issues. In the automotive domain, HARA is influenced by the ISO 26262 international standard which details functional safety of road vehicles. While ISO 26262 was a major step towards analysing hazards and risks, like other domains, it is also plagued by the issues of reliability. In this paper, the authors discuss the automotive HARA process. While exposing the reliability challenges of the HARA process detailed by the standard, the authors present an approach to overcome the reliability issues. The approach is obtained by creating a rule-set for automotive HARA to determine the Automotive Safety Integrity Level (ASIL) by parametrizing the individual components of an automotive HARA, i.e., severity, exposure and controllability. The initial rule-set was put to test by conducting a workshop involving international functional safety experts as participants in an experiment where rules were provided for severity and controllability ratings. Based on the qualitative results of the experiments, the rule-set was re-calibrated. The proposed HARA approach by the creation of a rule-set demonstrated reduction in variation. However, the caveat lies in the fact that the rule-set needs to be exhaustive or sufficiently explained in order to avoid any degree of subjective interpretation which is a source of variation and unreliability.

ISO 26262, the new automotive functional safety standard, aims to foster the design and development of safe products by ensuring that the risks posed by hazardous components are reduced to a residual level. Therefore, the standard defines and uses the concept of Automotive Safety Integrity Levels (ASILs) that classify the strictness of safety requirements to be assigned to the failure modes of the system based on the hazard they may cause. ASIL allocation can be described as a hard optimization problem focused on finding the optimal ASIL allocation that maximizes the safety requirements and minimizes cost. However, finding this optimal allocation among a set of possible allocations can represent a difficult task in large systems that contain a large number of components, which subsequently increases the search space. In this paper, we introduce a novel approach that uses the nature-inspired meta-heuristic Ant Colony Optimization (ACO) algorithm to solve the ASIL allocation problem and makes use of strategies that reduce the solution space. The problem was formulated as a construction graph, which the ants use to construct possible ASIL allocations. The search space reduction is accelerated considerably by both the effective performance of the ACO and the convergence of the algorithm on the optimal solution. This approach has been evaluated by applying it to a hybrid braking system and a steer-by-wire system. The results show a significant improvement over genetic-based, penguins search-based and tabu search-based approaches.

Future generations of automobiles (also known as cybercars) will further increase the proliferation of electronic control units (ECUs) to contrive novel infotainment and distributed control applications. International Organization for Standardization (ISO) 26262 is an automotive standard that designates automotive safety integrity levels (ASILs) to indicate the criticality associated with a function. This article aims to provide a concise discussion on the safety assessment and design of dependable cybercars considering the current state of the art and future perspectives. I will elaborate on the risk assessment and design of dependable cybercars as stipulated in ISO 26262 and classify failure modes in cybercars and the methods to assess these failures. I will also discuss various hardware architectural metrics to assess safety and dependability of a cybercar design as well as various research challenges and future research directions for realizing safe and dependable cybercars.

The released ISO 26262 standard for automotive systems requires to create a hazard analysis and risk assessment and to create safety goals, to break down these safety goals into functional safety requirements in the functional safety concept, to specify technical safety requirements in the safety requirements specification, and to perform several validation and verification activities. Experience shows that the definition of technical safety requirements and the planning and execution of validation and verification activities has to be done jointly by OEMs and suppliers. In this paper, we present a structured and model-based safety development approach for automotive systems. The different steps are based on Jackson's requirement engineering. The elements are represented by UML notation extended with stereotypes. The UML model enables a rigorous validation of several constraints. We make use of the results of previously published work to be able to focus on the OEM/supplier interface. We illustrate our method using a three-wheeled-tilting control system (3WTC) as running example and case study.

Electronic component is increasing in Automotive applications spanning from power train, connectivity, airbag, driver assistance, braking and more. Most of these components are Integrated Circuits that have to fulfill system safety requirements in sophisticated safety applications. A functional safety review and assessment are used to confirm whether integrated circuit component fulfills hardware safety and functional requirements derived from system safety goals. One such automotive safety system is the Airbag Control Unit with integrated Squib Drivers that deploys driver and passenger airbags when a valid car crash event is detected. Airbags are passive safety application, critical for driver and passenger safety that can be fatal if not deployed properly. Therefore, components used in airbag applications have to fulfill the highest system Automotive Safety Integrity Level (ASIL), ASIL-D. The safety critical part of Squib Driver Integrated Circuits is the High Side and Low Side powerFETs with its pre-drivers, control, monitoring, protection and diagnostics. This paper describes design Failure Mode Effect Analysis (FMEA) as one part of the systematic design methodology flow by using the low side current regulating driver as an example. This systematic approach resulted in a unique safety architecture that prevents inadvertent activation of the low side powerFET in the unpowered state of the driver. In the powered state, the current is regulated to 3A and is stable for inductances up to 3mH, a 30x higher inductive load than a traditional squib driver.

Automotive safety integrity level (ASIL) of a component decides the criticality associated with the system. This criticality involves cost and effort by original equipment manufacturers for developing the product. Since criticality increases with increase in ASIL, it is one of the major disadvantages on the part of OEMs to develop the complete system according to highest ASIL among all its components. In this paper, an efficient technique to resolve the issue of criticality by ASIL Decomposition is proposed in a detail way. In the later part of this paper, the incorporation of this technique to the automobile industry for developing an efficient system is explained using a case study.

Safety critical system development includes a wide set of techniques, methods and tools for assuring system safety. The concept of evidence is one of the key notions used to provide safety confidence to stakeholders. Safety goals must be identified during safety analysis. In addition, risks should also be considered and managed, and linked to the achievement of safety goals. This paper proposes an extension of the ISO/IEC 24744 metamodel for development methodologies in order to integrate the management of goals, risks and evidence into system development lifecycles in an ISO/IEC 15026-compliant manner that is related to the approach of assurance cases. The proposed extension is illustrated through a real-life scenario in the automotive domain where the system being developed must comply with ISO 26262, a standard in this domain. By using the proposed approach, the management of goals, risks and evidence in critical systems development is formalized and harmonized with different ISO/IEC standards, resulting in a more robust and systematic treatment of these crucial aspects., This work was partially supported by a grant from “Programa de Movilidad del Personal Investigador del Departamento de Educación, Política Lingüística y Cultura del Gobierno Vasco” (MV_2014_1_34) and funding from the FP7 programme under grant agreement number 289011 (OPENCOSS).

During a manufacturing process of automotive clutch an explosive substance – xenon is produced. Concentration of this substance must be monitored. Implementation of controls is performed by a safety-critical functions control system.Among main role during the process of risk assessment analysis belong determination of danger and dangerous events associated with the devices. Proactive planning errors and the use of appropriate standards can greatly reduce formation disorders thereby reducing the probability of dangerous consequences. The standard safety subsystems architectures and computation methods for determining the failure intensity is listed in the standards IEC 61508 and IEC 61511. These standards contain information tables with the results of these computations for selected parameter values.We propose a complete failure probability model for the safety functions of the control system. This model is designed to compute the intensity of the critical failure for the standard channel architectures.These architectures were designed with respect to the standard IEC 61508 and were implemented in Matlab.

Safety standards guide the development of systems whose operation raises concerns about safety. We focus our attention on the automotive and aerospace standards, ISO 26262 and ARP4754-A respectively. Both standards advocate a process for controlled allocation of safety integrity requirements that starts early in the design and continues as the system architecture is being refined. This procedure may generate a plethora of feasible design variants, all satisfying system safety requirement, but each having different allocations of integrity to components and different costs. In this paper, we describe a model-based safety analysis method for automating this allocation process in a way that cost-optimal design variants are selected. We show that the proposed method is generic and can satisfy both the automotive and aerospace safety standards with application to both industries. We apply the method using both standards on a common case study and discuss the differences in the results obtained, reflecting on the commonalities and differences between the two standards.

Existing automotive Hazard Analysis and Risk Assessment (HARA) process as discussed by the international standard ISO 26262 is static in nature. While the standard describes a systematic process to incorporate functional safety in the development process of Electrical & Electronic (E/E) systems, it fails to address the needs of Advanced Driver Assistance Systems (ADAS) and Automated Driving (AD) systems. In order to ensure the safety of ADAS and AD systems, it is important to incorporate the changing nature of interactions between the system and the environment, in the safety analysis process for ADAS and AD systems. In this paper, the authors argue the need for a dynamic approach for automotive safety analysis by adapting the tactical safety for ADAS and AD systems depending on the real-time operational capability and real-time ASIL (Automotive Safety Integrity Level) rating of a situation, and discuss a framework for this process. The novelty and therefore contribution of this paper lies in the proposed ASIL inspired dynamic tactical safety framework, which evaluates the severity, controllability and exposure ratings in real-time based on the real time values of the various vehicle and environment parameters. These ratings are used to assign a real-time ASIL value which is used to determine the tactical decisions in order to lower the ASIL value in real-time by altering the functional (operational) capability of the system. Furthermore, the framework is explained with the help of a case study based on a combined Adaptive Cruise Control (ACC) and Autonomous Emergency Braking (AEB) system.\ud

In this paper, we propose a hardware-in-the-loop simulation (HILS) for functional safety compliant electric power steering (EPS) system. The proliferation of electric and electronic systems in vehicles has brought the new automotive standard ISO 26262 for the safety of functions. The proposed EPS system should be Automotive Safety Integrity Level (ASIL) D compliant, which is the highest ASIL level. Therefore, EPS system complies with functional safety and HILS is configured to verify performance of functional safety compliant EPS system.

ISO 26262 is an international standard for the functional safety of electric and electronic systems in vehicles, and this standard has become a major issue in the automotive industry. In this paper, a functional safety compliant electronic control unit (ECU) for an electric power steering (EPS) system and a demonstration purposed EPS system are developed, and a software and hardware structure for a safety critical system is presented. EPS is the most recently introduced power steering technology for vehicles, and it can improve driver’s convenience and fuel efficiency. In conformity with the design process specified in ISO 26262, the Automotive Safety Integrity Level (ASIL) of an EPS system is evaluated, and hardware and software are designed based on an asymmetric dual processing unit architecture and an external watchdog. The developed EPS system effectively demonstrates the fault detection and diagnostic functions of a functional safety compliant ECU as well as the basic EPS functions.

According to ISO 26262 (the international standard on functional safety for automotive industry), the functional safety should be considered during the whole automotive systems life cycle from the design phase throughout the production phase. In order to satisfy the standard, the automotive and related industry needs to take appropriate actions while carrying out a variety of development activities. This paper presents an approach to coping with the standard. Analyzing the standard indicates that the safety issues of the automotive systems should be handled with a system`s view whereas the conventional approach to solving the issues has been practiced with focus on the component`s level. The aforementioned system`s view implies that the functional safety shall be incorporated in the system design from both the system`s life-cycle view and the hierarchical view for the structure. In light of this, the systems engineering framework can be quite appropriate in the functional safety development and thus has been taken in this paper as a problem solving approach. Of various design issues, the analysis and verification of the safety requirements for functional safety is a key study subject of the paper. Note, in particular, that the conventional FMEA (failure mode effects analysis) and FTA (fault tree analysis) methods seem to be partly relying on the insufficient experience and knowledge of the engineers. To improve this, a systematic method is studied here and the result is applied in the design of an ABS braking system as a case study.

Safety is one of the key issues of future automotive development. With the trend of increasing functionality and complexity in automotive embedded system, there are increasing risks of functional failures. It is necessary to perform the functional safety process throughout the safety lifecycle of these systems. The appearance of the new functional safety standard ISO WD 26262 also makes the consideration of functional safety as part of the design and implementation process for these systems. This paper introduces the new standard ISO WD 26262 and analyses its features. The safety life cycle according to the new standard, activities necessary for the achievement of functional safety during the development phase are shown. An example application according to ISO WD 26262 is given and the process and methods of functional safety analysis in this example are proposed.

Safety is always the key issue in automotive industry. The adoption of hi-tech automotive applications requires not only the development of reliable electrical/electronic/programmable electronic (E/E/PE) systems and communication protocols, but also an evolution in functional safety process management. ISO/WD 26262, the adaption of IEC 61508 for road vehicles, provides guidelines and standardized measurements for functional safety. This paper discusses how automotive microcontroller suppliers can deal with this new challenge by integrating functional safety management into product design and development. An ISO/WD 26262-compliant functional safety management flow is proposed, with specifications on techniques of corresponding safety assessment.

ISO 26262 - The Relevance and Importance of Qualitative and Quantitative Methods for Safety and Reliability Issues Regarding the Automotive Industry Safety and reliability are key issues of today's and future automotive developments, where the involved companies have to deal with increasing functionality and complexity of software-based car functions. New functionalities cannot only be found in the area of driver assistance - most of the new car functions are and will be safety related as for example in vehicle dynamics control or active and passive safety systems. The development and integration of those functions will strengthen the need of safe processes during the system development. The new upcoming automotive standard on functional safety (ISO 26262), which is derived from the generic functional safety standard IEC 61508 to comply with the specific needs to the application sector of E/E-systems in road vehicles, will provide guidance to avoid the increasing risks from systematic faults and random hardware faults by providing feasible processes and requirements. It is evident that aspects and methods of the safety and reliability engineering are implemented and suited methods are performed in the development process at an early stage. This is one of the requirements of the new ISO 26262, which introduces a so called automotive safety lifecycle to handle all those activities that are necessary to guarantee the functional safety of automotive E/E-systems. In the following, a brief overview of the upcoming automotive standard, its new safety life cycle and the connected activities in order to ensure functional safety for safety related systems will be given. The main aim of this paper is to show the relevance and importance of one of the major tasks within the ISO 26262: the process of the hazard analysis and risk assessment as it is currently performed in the automotive industry. With the help of an example from the automotive sector, the basic steps of this method to determine the automotive safety integrity level (ASIL) are explained. Depending on the ASIL, safety requirements need to be derived as a result of the new standard regarding safety integrity attributes. Furthermore, the connection of the automotive functional safety process with methods for qualification and quantification of safety and reliability issues will be explained in this paper. The Fault Tree Analysis will be used to exemplify one of these methods which are applied subsequent to the hazard analysis and risk assessment and which make a contribution to the validation and verification of the safety process.

If safety related systems are remanufactured, as for example steering systems, the functionality, the functional safety, the reliability and the quality have to fulfill the series standards such as the E/E/PE standard IEC 61508 or the automobile standard ISO 26262. This paper examines an investigation with the objective to present a prevention model with which the reliability and the renewal function of safety components for remanufactured systems can predict. Failure data serve as a basis and make the predict model not only to a theoretical, but also to a practical tool.

In the safety domain, safety standards are used as a development guideline to keep the risk at an acceptable level. Safety of the safety-critical systems can be assessed according to those safety standards. This assessment process is called safety assurance. Due to the manual work, the safety assurance process is usually costly, time consuming, and hard to be evaluated. In this paper we propose to use the existing the PSM framework into the automotive domain to design metrics according to the ISO 26262 standard. These metrics can identify costly processes in the safety assurance process. To demonstrate the method, a case study is carried on ISO 26262 part 3 (Conceptual Phase).

Because the automotive industry has become a global industry, the need for a common set of quality management system requirements has become imperative. In this regard, a new version of the international automotive specification ISO/TS 16949 is introduced. Some of the key messages of ISO/TS 16949 are the reduction of waste in the supply chain and that continual improvement is only applicable when conformity has been established. To ensure greater uniformity in ISO/TS 16949 certification, the International Automotive Task Force (IATF) designed a certification scheme in which they are the regulator for the automotive-specific requirements. As a result, opportunists in the certification business will be excluded and, unlike ISO 9000 certification, third-party auditors who cannot demonstrate their competency to independent examiners every three years will be removed from this sector.

International audience; Automotive embedded systems are becoming increasingly complex. Therefore verification activities are paramount to ensure safety. ISO 26262 is the first standard specifically dedicated to automotive safety systems. This standard requires introducing fault injection (FI) from the very early phases of the development process. Our work aims at developing an approach that will help integrate FI in the whole development process in a continuous way, from system requirements to the verification and validation phase. In this paper, we concentrate on exploring the benefits of safety analyses for experimental validation of the system. We propose an analogy between FI during the pre-implementation phase with safety analyses that are of common use during system design. We finally illustrate this approach on a case study from the automotive domain.

We present a model for structuring automotive safety arguments comprising four different, yet interrelated, layers of safety claims. The layered model is structured by the rationale behind safety requirements, their relationship to corresponding physical artefact(s) and hazardous events, the means used in their development and the environment in which safety activities are undertaken. The layered approach allows for focus and clarity in communicating and assessing the functional safety of automotive Electrical/Electronic systems, particularly in the context of the automotive standard ISO 26262.

With a significantly increasing number of electrical and electronic systems within road vehicles, the complexity of such systems dramatically increases. To prevent these increasingly complex systems from becoming more and more fault-prone is one of the most important challenges of the future. Systems have to be intrinsically safe whereby owing to the cost pressure within the automotive industry, it is not possible just to double or triple the systems, as it is usual in the avionics industry. This chapter describes the general concept of vehicle safety—especially with regard to functional safety that came into focus within recent years with the advent of a new standard for functional safety of road vehicles—the ISO 26262. This chapter gives an overview over the trends why safety of road vehicles becomes more and more important in future, what are the special constraints of the automotive industry. Furthermore, we explain the legal point of view and the key concept of ISO 26262, for example, the method of hazard analysis and risk assessment, the concept of SEooC (safety element out of context), the confidence in the use of software tools, and the random hardware faults and hardware metrics. Some side issues of vehicle safety such as the quality assurance concept and the OBD (on-board diagnosis) are described. Keywords: road vehicles; safety; functional safety; ISO 26262; automotive safety integrity level; ASIL ; product liability; qualification of software tools; quality assurance; diagnosis

Current vehicles are built with complex electronic systems embedded with more than a hundred microprocessors through complicated automotive networks. In the de facto ISO 26262 standard in the automotive industry, Automotive Safety Integrity Level (ASIL) is classified into four different levels. In this chapter, the ISO 26262 hardware ASIL is described in detail. Then, we introduce fault diagnosis architectures that use various design for testability techniques such as scan design, built-in self-test, IEEE boundary scan design, and error correcting codes for increasing hardware reliability.

The released ISO 26262 standard requires a hazard analysis and risk assessment for automotive systems to determine the necessary safety measures to be implemented for a certain feature. In this paper, we present a structured and model-based hazard analysis and risk assessment method for automotive systems. The hazard analysis and risk assessment are based on a requirements engineering process using problem frames. Their elements are represented by a UML notation extended with stereotypes. The UML model enables a rigorous validation of several constraints expressed in OCL. We illustrate our method using an electronic steering column lock system.

Safety engineering standards define rigorous and controllable processes for system development. Nevertheless, safety standards differences from distinct domains are non-negligible. We focus in particular on the aviation, automotive and railway standards, all related to the transportation market. We argue that the Safety Integrity Levels are not sufficient to be used as a top level requirement for developing a safety critical system. We argue that Quality of Service is a more generic criterion that takes the trustworthiness as perceived by users into deeper account. In addition safety engineering standards provide very little guidance on how to compose safe systems from components, while this is the established engineering practice. We develop a novel normative concept called Assured Reliability and Resilience Level as a criterion that takes the industrial practice into account and show how it complements the Safety Integrity Level concept. An important difference is that it requires a component to carry a contract and the supporting evidence. ARRL can make a significant contribution to foster cross-domain safety engineering.

The ISO 26262 standard is strongly affecting today's development behavior in the Automotive Industry. It defines the new development process requirements for the shift from the quality management system (QMS, ISO/TS 16949) to a safety oriented work culture. There are four key barriers to make this shift; 1) the existing business decision environment based only on cost, 2) the typical project work culture to directly jump to a solution without first defining the requirements (as defined by the “V” model), 3) the knowledge gap on how to shift from qualitative to quantitative product reliability assessment and 4) the time and awareness to manage the implementation of the additional safety confirmation measures. The challenge for the automotive industry is to overcome these barriers as established with the ISO/TS16949 quality management system processes. The ISO 26262 standard has covered the first three barriers by; 1) defining the requirements for a good safety culture, 2) deriving the safety requirements from the “Top Down”, 3) providing a quantitative product reliability or failure in Time (FIT) methodology. However, the standard only defined how a single developer needs to manage the functional safety but not how to address the development interfaces between the multiple organization during the safety lifecycle. With the learning from the Aerospace & Aviation industry it would be beneficial to the Automotive Industry to improve the interaction between the distributed developers. The Aerospace & Aviations “Flight Readiness Review” is a proven Safety Management Review network. To further improve the management of functional safety in the Automotive industry, this paper proposes to incorporate a “Safety Manager Review” network within the next revision of the ISO 26262 standard. The key benefits that would be achieved are: 1) Provide “closed loop” learning with common definitions throughout the multiple organisation. 2) Earlier resolution of the safety anomalies during the product lifecycle. 3) A more effective Management of Functional Safety by implementing the decisions based on field data. With this proposal in place the multiple organisation would have a better chance to confirm that the Safety Function complies adequately to the quantitative targets. Only when all three levels of the distributed developers have the same process language and quantitative units, the safety targets can be accomplished.

ISO 26262 is considered to represent the “state of the art” for the development of vehicle electronic systems, specifically of safety relevant systems in passenger vehicles. ISO 26262 is an automotive interpretation of the generic functional safety standard IEC 61508 [1]. Premium segment passenger vehicles are equipped with a vast number of control units to deliver sophisticated functions, from the standard ABS (Anti-lock braking system) to the novel intelligent park assist. This reliance on electronic systems has turned the attention to functional safety, so that the emphasis is in addressing hazards that can result from malfunctions on the electronics systems, as per the defined scope in ISO 26262. The development phase of ISO 26262 (in Parts 4, 5 and 6 of the standard) follows on from the activities of the concept phase (Part 3 of the standard) [3]. The concept phase activities are based on preliminary architectural descriptions of the “item” and high level requirements to satisfy overarching safety goals and are intended to be implementation-independent. However in the development phase the specific objective is to determine how those requirements are implemented in technical solutions by the different elements that constitute the item. The design phase activities of ISO 26262 Part 4 are concerned with the design of a specific system implementation, still at an architectural level, with the detail of hardware and software design and implementation covered by the requirements of Parts 5 and 6 respectively.

ISO 26262 - "Road vehicles-Functional Safety" is a standard for the automotive industry, administered in an attempt to prevent potential accidents due to systematic and random failures in the Electrical/Electronic-system. ISO 26262 is based on the principle of relying on safety requirements as the main source of information to enforce correctness of design. We show that the contract theory from the SPEEDS FP6 project provides a suitable foundation to structure safety requirements in ISO 26262. Contracts provide the necessary support to separate the responsibilities between a system and its environment by explicitly imposing requirements on the environment as assumptions, in order to guarantee the safety requirements. We show this by characterizing two levels of safety requirements with contracts for an industrial system where we also show how contract theory supports the verification of consistency and completeness of safety requirements.

The automotive industry has successfully collaborated to release the ISO 26262 standard for developing safe software for cars. The standard describes in detail how to conduct hazard analysis and risk assessments to determine the necessary safety measures for each feature. However, the standard does not concern threat analysis for malicious attackers or how to select appropriate security countermeasures. We propose the application of ISO 27001 for this purpose and show how it can be applied together with ISO 26262. We show how ISO 26262 documentation can be re-used and enhanced to satisfy the analysis and documentation demands of the ISO 27001 standard. We illustrate our approach based on an electronic steering column lock system.

The newly released automotive safety standard ISO 26262 entitled ‘Road vehicles—Functional Safety’ gives the guidelines to demonstrate safety compliance of a product design. The standard describes the safety implementation process considering the total product life cycle. Based on the hazard and risk analysis carried out on the functionality of an item, the functional safety requirements are derived. For each of these functional safety requirements the technical safety requirements are specified with respect to Hardware and Software design. The standard has several requirements in order to prove the safety compliance with respect to Hardware and software design. In this paper one of the requirements in the hardware design which is known as HW Architectural metrics and Probabilistic Metric for random Hardware Failures is discussed. This is a quantitative assessment of a design with respect to technical safety requirements. The merits of each of these calculations are demonstrated using a simple example of a solenoid valve driver control circuit. The paper also discusses certain challenges in carrying out these analyses.

The ISO 26262 functional safety standard provides appropriate development processes, requirements and safety integrity levels specific for the automotive domain. One crucial requirement consists of the creation of a safety case, a structured argument, which inter-relates evidence and claims, needed to show that safety-critical systems are acceptably safe. The standard is currently not mandatory to be applied to safety critical systems installed in heavy trucks, however, this is likely to be changed by 2016. This paper describes the experience gathered by applying the standard to the Fuel Level Estimation and Display System, a subsystem that together with other subsystems plays a significant role in terms of global system safety for heavy trucks manufactured by Scania. More specifically, exploratory and laborious work related to the creation of a safety case in compliance with ISO 26262 in an inexperienced industrial setting is described, and the paper ends with presenting some lessons learned together with guidelines to facilitate the adoption of ISO 26262.

Standard approaches to functional safety as described in the automotive functional safety standard ISO 26262 are focused on reducing the risk of hazards due to random hardware faults or systematic failures during design (e.g. software bugs). However, as vehicle systems become increasingly complex and ever more connected to the internet of things, a third source of hazard must be considered, that of intentional manipulation of the electrical/electronic control systems either via direct physical contact or via the systems' open interfaces. This article describes how the process prescribed by the ISO 26262 can be extended with methods from the domain of embedded security to protect the systems against this third source of hazard.

In the automotive domain the standard ISO 26262 places significant emphasis on the assignment of Automotive Safety Integrity Levels (ASILs). In particular much of Part 3 of the standard is dedicated to the process that determines the three factors that contribute to the final assigned ASIL value: exposure, severity and controllability. In this paper we examine some of the issues that the authors have encountered during the development of an in-wheel electric motor and will argue that the perceived emphasis on ASIL ratings, in the context of developing a safe system, is misplaced and potentially counterproductive. (8 pages)

The introduction of the new automotive standard on functional safety ISO 26262 raises different challenges from the process point of view. Hence, a standardized process mapping roles, activities and work products according to ISO 26262 needs to be defined. This process has to be tailored according to the automotive safety integrity level (ASIL) and to company specific practices and teams. In this work, we propose a method content approach modeled with SPEM in order to define and formalize development processes, enabling better management and easier tailoring activities.

In the automotive domain, there is currently no formal requirement to produce an explicit safety case. Instead the implicit safety case for a vehicle is comprised of compliance with extensive national and international regulation and standards. With the imminent introduction of the automotive functional safety standard ISO 26262, the production of a functional safety case is now a requirement for compliance with the standard. This presents both opportunities and challenges to safety practitioners and researchers within that industry. This paper sets out what form an ISO 26262 safety case might take and how this fits within the existing hierarchy of automotive safety, based on the experiences of the authors who are actively engaged the development and delivery of real automotive projects. Using the pattern and modular extensions of the Goal Structuring Notation (GSN) a number of reusable safety arguments are proposed covering all parts of ISO 26262 and the issues of compliance and assurance. The patterns proposed are not instantiated for confidentiality reasons but are provided to give guidance and shared learning for others within the automotive functional safety community. (6 pages)

The draft international standard under development ISO 26262 (Road Vehicles — Functional safety —) describes a safety lifecycle for road vehicles and thereby influences all parts of development, production, operation and decommissioning. Starting from 2011, all developments of new cars should be aligned to this standard. The rapid application and adaption of the ISO 26262 is mandatory to develop safe, advanced and competitive automotive systems and systems of systems. The failure mode and effect analysis (FMEA) is a well applied engineering quality method in the automotive industry and proposed by the ISO 26262 for several analyses. The communication structure of the automotive control system are specified by the electric and electronic architecture (EEA). For a short time all this information can be processed in one tool. It can form an important contribution to the determination of input data for safety assessments. With the FMEA flow embedded in the EEA modeling, analysis can be rapidly provided with altered input data resulting from architecture modifications. This paper presents a formalized tool flow for rapid determination and accumulation of input data for failure mode and effect analysis based on an EEA model, the accomplishment of the analysis within an EEA modeling tool and the automated generation of reports, documenting the results from the FMEA according to a predefined form.

In this paper, we describe a concept for the automatic allocationof general Safety Integrity Levels (SILs) to subsystems andcomponents of complex hierarchical networked architectures thatdeliver sets of safety critical functions. The concept is generic andcan be adapted to facilitate the safety engineering approachdefined in several standards that employ the concept of integrityor assurance levels including ISO 26262, the emergingautomotive safety standard. SIL allocation is facilitated by HiPHOPS,an automated safety analysis tool, and can be performed inthe context of development using EAST-ADL2, an automotivearchitecture description language. The process rationalizescomplex risk allocation and leads to optimal/economic allocationof SILs. QC 20120302

Future generations of electric vehicles (EVs) will require a new level of convergence between computer and automotive architectures, with the electric power train being a mechatronic system that includes a multitude of plug and play devices, embedded power and signal processing hardware, software and high level algorithms. This paper discusses the current advances in the computing devices, communication systems and management algorithms embedded in the EV building blocks used for implementing the distributed energy and propulsion architectures required for high efficiency, reduced complexity and safe redundancy.