Search

Hazard Analysis and Risk Assessment (HARA) in various domains like automotive, aviation, and process industry suffers from the issues of validity and reliability. While there has been an increasing appreciation of this subject, there have been limited approaches to overcome these issues. In the automotive domain, HARA is influenced by the ISO 26262 international standard which details functional safety of road vehicles. While ISO 26262 was a major step towards analysing hazards and risks, like other domains, it is also plagued by the issues of reliability. In this paper, the authors discuss the automotive HARA process. While exposing the reliability challenges of the HARA process detailed by the standard, the authors present an approach to overcome the reliability issues. The approach is obtained by creating a rule-set for automotive HARA to determine the Automotive Safety Integrity Level (ASIL) by parametrizing the individual components of an automotive HARA, i.e., severity, exposure and controllability. The initial rule-set was put to test by conducting a workshop involving international functional safety experts as participants in an experiment where rules were provided for severity and controllability ratings. Based on the qualitative results of the experiments, the rule-set was re-calibrated. The proposed HARA approach by the creation of a rule-set demonstrated reduction in variation. However, the caveat lies in the fact that the rule-set needs to be exhaustive or sufficiently explained in order to avoid any degree of subjective interpretation which is a source of variation and unreliability.

An important issue concerning the use of safety standards in the design of a complex system is the proper evaluation of the risks. The risk is correlated to the probability of failure, then to the failure rate, and it plays a fundamental role in the safety assessment process. This paper focuses on the failure rate evaluation methods adopted by the following functional safety standards: ISO 19014, ISO 25119, and IEC 61508. All of these standards are applicable, respectively, in the earth-moving machinery, in the tractors and machinery for agriculture and forestry, and in the industrial automation fields. As proposed by the standards, the failure rate evaluation depends on the conventional parameters like Mean Time To Failure, Diagnostic Coverage level, and Hardware Categories. Nevertheless, assuming the same value of these parameters, the results obtained adopting the suggested methods from different standards are not always the same. The aim of this paper is to give an analytical approach to calculate, on a common basis, the failure rate starting from a certain set of input parameters. In addition, the approximations are analysed in order to identify the correct assumptions for the proper application of all these “not exact” values in each application field.

The released ISO 26262 standard for automotive systems requires to create a hazard analysis and risk assessment and to create safety goals, to break down these safety goals into functional safety requirements in the functional safety concept, to specify technical safety requirements in the safety requirements specification, and to perform several validation and verification activities. Experience shows that the definition of technical safety requirements and the planning and execution of validation and verification activities has to be done jointly by OEMs and suppliers. In this paper, we present a structured and model-based safety development approach for automotive systems. The different steps are based on Jackson's requirement engineering. The elements are represented by UML notation extended with stereotypes. The UML model enables a rigorous validation of several constraints. We make use of the results of previously published work to be able to focus on the OEM/supplier interface. We illustrate our method using a three-wheeled-tilting control system (3WTC) as running example and case study.

It is getting mandatory to comply with ISO26262 in the recent automotive development. The implementation of safety mechanism to detect faults is one of the keys in ISO26262. The fault prediction will make the automotive system more reliable. The SoC in this paper introduces two features: hardware built-in self-test (BIST) for safety mechanism supporting automotive safety integrity level (ASIL) B and killer-droop monitor for fault prediction. In addition, time slicing is introduced to the testing with hardware BIST during runtime so that each test session can be shorter than the required interrupt response time in the application. The killer-droop monitor can predict the voltage droop and stop the clock supply for a certain period of time to mitigate the droop for preventing delay faults on the SoC. The monitor samples the voltage based on time-to-digital converter at CPU operation clock and predicts the voltage from the history of sampled voltage. With that prediction feature, the minimum operation voltage can be improved by 50 mV at 2.02 GHz CPU operation, and the maximum frequency can be improved by 140 MHz under 0.82 V power supply in 16 nm process.

During a manufacturing process of automotive clutch an explosive substance – xenon is produced. Concentration of this substance must be monitored. Implementation of controls is performed by a safety-critical functions control system.Among main role during the process of risk assessment analysis belong determination of danger and dangerous events associated with the devices. Proactive planning errors and the use of appropriate standards can greatly reduce formation disorders thereby reducing the probability of dangerous consequences. The standard safety subsystems architectures and computation methods for determining the failure intensity is listed in the standards IEC 61508 and IEC 61511. These standards contain information tables with the results of these computations for selected parameter values.We propose a complete failure probability model for the safety functions of the control system. This model is designed to compute the intensity of the critical failure for the standard channel architectures.These architectures were designed with respect to the standard IEC 61508 and were implemented in Matlab.

Safety and security aspects consist of two different group of functional requirements for the control and protection systems. In the paper it is proposed that the security analysis results can be used as a factor increasing or decreasing the risk level. It concerns a process of determining required safety integrity level of given safety functions. The authors propose a new approach for functional safety risk analysis. In this case the security factor influences the value of required safety integrity level SIL by changing the frequency of accident scenario. It can be done by using the methodology of modified risk graph. On the other hand there is a verification of required SIL fulfillment for designed safety-related system which implements safety function. In this case the result of security analysis is affecting uncertainty of probabilistic model parameters. The proposed method takes into consideration the sensitivity analysis of probabilistic models of E/E/PE or safety instrumented systems SIS as well as the uncertainty of probabilistic results. It uses differential factors, which are helpful for effective verification of required SIL of the E/E/PE or SIS systems taking into account results of sensitivity analysis and/or assessment of uncertainty ranges obtained from probabilistic models developed.

For safety-critical systems including railways, there has been a growing need for effective and systematic safety management processes. The outcomes of efforts in this area are international safety standards, such as IEC 61508, 62278, and ISO 26262. One of the principal activities in the safety process is hazard analysis. For this reason,considerable efforts have been directed toward methods of hazard analysis. On the other hand, the hazard analysis methods reported thus far appear to be unclear in terms of their relationship with the system design process. In addition, in some cases, the methods appear to rely heavily on information regarding the hardware and software components, the number of which is increasing. These aspects can become troublesome when design changes are necessary. To improve the situation, in this paper, hazard analysis was carried out using the result of functional analysis early in the concept development stage for a safety-critical system design. Because hazard analysis is carriedout at the system level and the result is then used to develop the safety requirements, improvements can be expectedin terms of the development time and cost when design changes are required due to changes in the requirements.As a case study, the generation of safety requirements for the development of light rail transit stations is presented.

Functional safety is related to the safety functions of a safety-related system that uses electrical/electronic/programmable (E/E/PE) devices such as sensors, logic solvers, and final elements. A legacy system is a safety-related system which offers safety functions but which was not designed to comply with the IEC 61508 standard. This paper presents a procedure for assessing the hardware safety integrity of a legacy system so as to confirm its functional safety. The procedure defines the systematic relationship between the safety function and hardware system using a function-structure map (FSM) and assesses the hardware safety integrity centered on the safety function. The proposed procedure is applied to a boiler control system of a fossil-fuel power plant.

Safety standards guide the development of systems whose operation raises concerns about safety. We focus our attention on the automotive and aerospace standards, ISO 26262 and ARP4754-A respectively. Both standards advocate a process for controlled allocation of safety integrity requirements that starts early in the design and continues as the system architecture is being refined. This procedure may generate a plethora of feasible design variants, all satisfying system safety requirement, but each having different allocations of integrity to components and different costs. In this paper, we describe a model-based safety analysis method for automating this allocation process in a way that cost-optimal design variants are selected. We show that the proposed method is generic and can satisfy both the automotive and aerospace safety standards with application to both industries. We apply the method using both standards on a common case study and discuss the differences in the results obtained, reflecting on the commonalities and differences between the two standards.

Existing automotive Hazard Analysis and Risk Assessment (HARA) process as discussed by the international standard ISO 26262 is static in nature. While the standard describes a systematic process to incorporate functional safety in the development process of Electrical & Electronic (E/E) systems, it fails to address the needs of Advanced Driver Assistance Systems (ADAS) and Automated Driving (AD) systems. In order to ensure the safety of ADAS and AD systems, it is important to incorporate the changing nature of interactions between the system and the environment, in the safety analysis process for ADAS and AD systems. In this paper, the authors argue the need for a dynamic approach for automotive safety analysis by adapting the tactical safety for ADAS and AD systems depending on the real-time operational capability and real-time ASIL (Automotive Safety Integrity Level) rating of a situation, and discuss a framework for this process. The novelty and therefore contribution of this paper lies in the proposed ASIL inspired dynamic tactical safety framework, which evaluates the severity, controllability and exposure ratings in real-time based on the real time values of the various vehicle and environment parameters. These ratings are used to assign a real-time ASIL value which is used to determine the tactical decisions in order to lower the ASIL value in real-time by altering the functional (operational) capability of the system. Furthermore, the framework is explained with the help of a case study based on a combined Adaptive Cruise Control (ACC) and Autonomous Emergency Braking (AEB) system.\ud

IEC 61508 standard provides a structured approach relying on hazards identification in order to establish safety requirements for safety instrumented systems (SISs). It aims at designing and operating the SIS within a reliability confidence that meets these requirements. The object of this paper is to give a concise description of IEC 61508 approach and to demonstrate it for the evaluation of safety barriers intervening against overpressure implemented on a butane storage tank. Specifically, the risk graph and layer of protection analysis approaches suggested in IEC 61508 for the determination of safety requirements are illustrated. In addition, it is shown that the use of more elaborate reliability approaches, such as fault tree and Markov graph, could be required for an effective risk assessment process. Actually, these approaches allow to consider the real configuration and operating conditions of the studied system.

This paper introduces the architecture of the power supply in order to achieve the safety integrity target for power supply which is a part of safety related system. The integrity level for safety is set 4 and according to the IEC 62425 which is standard for railway application the architecture design is conducted and process for design is developed. The procedure for design consists with 6 steps. The architecture of power supply that is able to keep the safety integrity against of failure of power supply is derived through the analysis and it is suggested that the power supply adopted the result in this paper is suitable to apply in safety system. Also, the failure frequency that is a quantitative value for the power supply is proposed.

In this paper, we propose a hardware-in-the-loop simulation (HILS) for functional safety compliant electric power steering (EPS) system. The proliferation of electric and electronic systems in vehicles has brought the new automotive standard ISO 26262 for the safety of functions. The proposed EPS system should be Automotive Safety Integrity Level (ASIL) D compliant, which is the highest ASIL level. Therefore, EPS system complies with functional safety and HILS is configured to verify performance of functional safety compliant EPS system.

The article deals with different procedures for determining the safety integrity level and its applications. The purpose of this research was to evaluate the system and associate it with certain safety integrity level. In this article, we will use IEC 61508, IEC 61511 and IEC 62061 for comparison. The first standard is specified as the superior standard for all safety-critical systems. The second one acts as an extension of the superior standard in the field of functional safety. The last one is aimed at machinery safety.

ISO 26262 is an international standard for the functional safety of electric and electronic systems in vehicles, and this standard has become a major issue in the automotive industry. In this paper, a functional safety compliant electronic control unit (ECU) for an electric power steering (EPS) system and a demonstration purposed EPS system are developed, and a software and hardware structure for a safety critical system is presented. EPS is the most recently introduced power steering technology for vehicles, and it can improve driver’s convenience and fuel efficiency. In conformity with the design process specified in ISO 26262, the Automotive Safety Integrity Level (ASIL) of an EPS system is evaluated, and hardware and software are designed based on an asymmetric dual processing unit architecture and an external watchdog. The developed EPS system effectively demonstrates the fault detection and diagnostic functions of a functional safety compliant ECU as well as the basic EPS functions.

Within the framework of railroad transportation systems, there are currently system rooms where critical systems such as signalization are available. For the system to achieve an uninterrupted mode of operation, it is crucial to mitigate risks or hazards against the rooms and to ensure an acceptable level of safety. This study handles the protection of a system room, owned by Istanbul Ulasim A.S. Edirnekapi branch, against an incident of fire as a safety-related system practice. Within this scope, the fire safety system has been handled as a safety-related system identified in IEC 61508. The safety integrity level required by the safety lifecycle for the relevant system has also been identified and safety functions that are required to be implemented have been put forth. Taking IEC 61508 as a reference for the functions, the required analyses have been performed through fault tree analysis. It has also been guaranteed that the relevant functions have met the required safety levels.

Integrated circuits used in high-reliability applications must demonstrate low failure rates and high-levels of fault detection coverage. Safety Integrity Level (SIL) metrics indicated by the general IEC 61508 standard and the derived Automotive Safety Integrity Level (ASIL) specified by the ISO 26262 standard specify specific failure (FIT) rates and fault coverage metrics (e.g. SPFM and LFM) that must met. To demonstrate that an integrated circuit meets these expectations requires a combination of expert design analysis combined with fault injection (FI) simulations. During FI simulations, specific hardware faults (e.g. transients, stuck-at) are injected in specific nodes of the circuits (e.g. flip flops or logic gates). Designing an effective fault-injection platform is challenging, especially designing a platform that can be re used effectively across designs. We propose an architecture for a complete FI platform, easily integrated into a general-purpose design verification environment (DVE) that is implemented using UVM. The proposed fault simulation methodology is augmented using static analysis techniques based on fault propagation probability assessment and clustering approaches accelerating the fault simulation campaigns. The overall framework aims to: identify safety-threatening device features, provide objective failure metric and support design improvement efforts. We present a worked example where a 32-bit RISC V CPU has been subjected to an extensive static and dynamic failure analysis process, as a part of a standard-mandated functional safety assessment.

As a large number of electrical and electronic equipment is introduced into the car, the reliability and safety of MCU becomes increasingly important. When the vehicle safety failure occurs, it must enter a safe driving state to ensure that the vehicle is traveling in the safest mode, so it is necessary to analyze the functional safety of MCU. Based on the road safety standard ISO 26262 and the running characteristics of MCU system, this paper analyzes and evaluates the safety goals, functional safety requirements and technical safety requirements of MCU system. From the analysis results, functional safety analysis of MCU can effectively improve its safety and reliability, and it provides guidance for later development.

According to the requirements of ISO 26262, the functional safety analysis of the corresponding system, the use of hazard analysis and risk assessment of the system has different functions and their corresponding failure of the car safety integrity level (ASIL, Automotive Safety Integrity Level). Then, the modified FMEA method based on fuzzy rule base and gray relational degree is introduced into the functional safety analysis. Taking the BMS (Battery Management System) as an example, the fuzzy rule based of BMS is established, including fuzzy language term set and the corresponding fuzzy number, and the FMEA group to evaluate the various failure modes, and then use the gray correlation theory to calculate the correlation degree of various failure modes, by sorting to determine the risk of failure mode sequence, in general, the failure mode with the higher the risk ranking, the higher the ASIL level.

Functional safety of a system is the part of its overall safety that depends on the system operating correctly in response to its inputs. Safety is defined as the absence of unacceptable/unreasonable risk by functional safety standards, which enforce safety requirements in each phase of the development process of safety-critical software and hardware systems. Acceptability of risks is judged within a framework of analysis with contextual and cultural aspects by individuals who may introduce subjectivity and misconceptions in the assessment. While functional safety standards elaborate much on the avoidance of unreasonable risk in the development of safety-critical software and hardware systems, little is addressed on the issue of avoiding unreasonable judgments of risk. Through the studies of common fallacies in risk perception and ethics, we present a moral-psychological analysis of functional safety standards and propose plausible improvements of the involved risk-related decision making processes, with a focus on the notion of an acceptable residual risk. As a functional safety reference model, we use the functional safety standard ISO 26262, which addresses potential hazards caused by malfunctions of software and hardware systems within road vehicles and defines safety measures that are required to achieve an acceptable level of safety. The analysis points out the critical importance of a robust safety culture with developed countermeasures to the common fallacies in risk perception, which are not addressed by contemporary functional safety standards. We argue that functional safety standards should be complemented with the analysis of potential hazards caused by fallacies in risk perception, their countermeasures, and the requirement that residual risks must be explicated, motivated, and accompanied by a plan for their continuous reduction. This approach becomes especially important in contemporary developed autonomous vehicles with increasing computational control by increasingly intelligent software applications.

This paper illustrates the application of a Safe by Design approach developed by the process industries to determine the effectiveness of arc flash\blast risk control techniques using functional safety techniques used to determine the integrity of emergency shutdown systems. It is proposed that with the adoption of risk analysis practices detailed in NFPA70E-2015 Informative Annex F Risk Assessment Procedure, the risk assessment process lends itself to calibration with the process and machinery functional safety standards, (ISA84.01, IEC 61508, IEC 61511, IEC 62061), for electrical/electronic/programmable electronic safety systems. Using this approach, it is possible to determine the Safety Integrity Level (SIL) requirements of the Arc Flash\Blast risk control system and design it in the same manner as a process emergency shutdown system, and/or a machinery safety system. Using this approach in the design phase enables you to build a defendable and economical arc flash mitigation system and also demonstrate duty of care has been exercised. Worked examples are utilized to demonstrate the application and use of the technique.

There is no plant in the world which is free from any risk, but lessons learned from a disaster was realized only after the Bhopal incident, and there are a number of standards are now in effect. In order to mitigate risks, it is necessary to develop risk analysis through a risk matrix, risk ranking, and consequence calculation, which have been discussed for avoidance catastrophic consequences. For better understanding, basics of mathematics have been covered. Plant ageing, and fault tolerance issues are also important topics to be covered. Functional safety through instrumentation is a call of the day for meeting challenges for risk control. How to handle basic and control and safety in safety instrumented systems (SISs) have been covered so that required safety integrity level (SIL), demanded by various standards, have been discussed at a basic level to develop further hazard analysis and SIS.

Date of Conference: 23-26 Jan. 2017 Conference name: 2017 Annual Reliability and Maintainability Symposium (RAMS) Nowadays, Safety-critical computers are extensively used in may civil domains like transportation including railways, avionics and automotive. We noticed that in design of some previous works, some critical safety design parameters like failure diagnostic coverage (DC) or common cause failure (CCF) ratio have not been seriously taken into account. Moreover, in some cases safety has not been compared with standard safety levels (IEC-61508 SIL1-SIL4) or even have not met them. Most often, it is not very clear that which part of the system is the Achilles' heel and how design can be improved to reach standard safety levels. Motivated by such design ambiguities, we aim to study the effect of various design parameters on safety in some prevalent safety configurations: 1oo2 and 2oo3. 1oo1 is also used as a reference. By employing Markov modeling, sensitivity of safety to each of the following critical design parameters is analyzed: failure rate of processing element, failure diagnostics coverage, common cause failures and repair rates. This study gives a deeper sense regarding influence of variation in design parameters over safety. Consequently, to meet appropriate safety integrity level, instead of improving some system parts blindly, it will be possible to make an informed decision on more relevant parameters. © 2017 IEEE.

We face two difficulties when applying ISO 26262[1] in the concept phase. ISO 26262 is the functional safety standard in the automobile field and requires strict safety requirements. Usually, it is not easy to divide requirements into safety parts and non-safety parts because they are closely connected with each other. That is, we have to perform two activities, functional development and functional safety activity, simultaneously. Other difficulty is a term item. From the definition, the item is a 'system 1.129 or array of systems to implement a function at the vehicle level'. In concept phase, we apply hazard analysis to an item, not system. The system definition comes after item definition and hazard analysis and risk assessment. So, it is hard to use the conventional methods e.g. Failure Mode and Effect Analysis FMEA and Fault Tree Analysis FTA.

To determine a proper ASIL for each hazardous event with a proper safety goal, the right classes should first be determined for the three properties of the hazardous event; (i) severity of harm from the resultant accident, (ii) exposure to the relevant operational situation, and (iii) controllability to avoid the induced risks. ASIL can be clearly determined with right classes of these three properties. But no specific methodologies or processes for their classification can be found in ISO 26262, except only a rough guideline with a simplified set of illustrative tables. In this paper, we try to present a systematic model for classifying the three properties of the hazardous event and suggest a refined procedure of ASIL determination. The proposed model provides a specific method to get a more objective ASIL compared with that in the standard. Scrutinizing the current methodology, we develop a refined method and also provide an illustrative example.

ISO 26262, a functional-safety standard, uses Automotive Safety Integrity Levels (ASILs) to assign safety requirements to automotive-system elements. System designers initially assign ASILs to system-level hazards and then allocate them to elements of the refined system architecture. Through ASIL decomposition, designers can divide a function's safety requirements among multiple components. However, in practice, manual ASIL decomposition is difficult and produces varying results. To overcome this problem, a new tool automates ASIL allocation and decomposition. It supports the system and software engineering life cycle by enabling users to efficiently allocate safety requirements regarding systematic failures in the design of critical embedded computer systems. The tool is applicable to industries with a similar concept of safety integrity levels.

To meet the growing needs from a variety of stakeholders, the development of modern systems is getting more complex and thus, the systems failure in the actual operations can potentially become more serious. This is why several international or military standards on systems safety have been published. In spite of the importance of meeting those standards such as IEC 61508 and ISO 26262 in the systems development, the associated practical methods seem deficient since those standards do not provide them. The objective of this paper is to present a method to identify potential hazards in fulfilling the requirements of the safety standards. In particular, the approach taken here is based on applying the functional analysis that covers several levels of the system under development. Note, however, that in the most of the conventional methods for hazards identification, the analysis has been focused on the failure at or underneath the component level of the system. The hazards identification method in this paper would cover the level up to the system by utilizing the functions-oriented approach. The case study of the safety enhancement for locomotive cabs is also discussed.

According to ISO 26262 (the international standard on functional safety for automotive industry), the functional safety should be considered during the whole automotive systems life cycle from the design phase throughout the production phase. In order to satisfy the standard, the automotive and related industry needs to take appropriate actions while carrying out a variety of development activities. This paper presents an approach to coping with the standard. Analyzing the standard indicates that the safety issues of the automotive systems should be handled with a system`s view whereas the conventional approach to solving the issues has been practiced with focus on the component`s level. The aforementioned system`s view implies that the functional safety shall be incorporated in the system design from both the system`s life-cycle view and the hierarchical view for the structure. In light of this, the systems engineering framework can be quite appropriate in the functional safety development and thus has been taken in this paper as a problem solving approach. Of various design issues, the analysis and verification of the safety requirements for functional safety is a key study subject of the paper. Note, in particular, that the conventional FMEA (failure mode effects analysis) and FTA (fault tree analysis) methods seem to be partly relying on the insufficient experience and knowledge of the engineers. To improve this, a systematic method is studied here and the result is applied in the design of an ABS braking system as a case study.

New drive concepts as well as advanced driver assistance systems and revised basic functions belong to the main innovation areas in today's automotive industry. Since thereby more and more electric / electronic components are integrated in modern passenger cars, the complexity is steadily increasing. Additionally, a crucial part of the innovations focuses on active and passive safety. Together, this creates tough demands on systems reliability and functionality which influence the development. Addressing the development process of electric / electronic components for passenger cars, the ISO 26262 "Road vehicles - Functional safety" came into effect in November 2011 ([1]). This standard introduces a safety lifecycle which "encompasses the principal safety activities during the concept phase, product development, production, operation, service and decommissioning" ([1], part 2, p.3) and which can be seen as a guideline that demands a risk-based development approach with seamless traceability. Already in the beginning of this safety lifecycle, in particular during the concept phase (cf. [1], part 3), a hazard analysis and risk assessment needs to be performed for the item under development. Within this process, hazards are identified, combined with possible operational situations for the car, and relevant outcomes of these combinations, namely the hazardous events, are classified to determine the automotive safety integrity level (ASIL) for the item. In this paper we address this hazard analysis and risk assessment. We developed a formalized hazard description language that enables a precise formulation of hazardous events based on four potential contributing factors. Moreover, it is shown how safety goals can be derived from these formalized hazardous events. In a further step it is described how the concepts presented in the paper on the one hand permit checking the implemented safety measures with respect to the risk mitigation which is achieved and on the other hand enables the application of model-based safety analyses in order to verify safety characteristics. Language: en

Besides cost issue, the charging infrastructures popularization and charging safety assurance are two major concerns for promoting electric vehicles (EVs). Several pilot-run programs, such as in the U.S., Europe, Japan, China, and Taiwan as well, enforce the safety compliance of EVs and infrastructures as an implementation policy. To be part of the players, it is essential to have the comprehensive understanding of the standard differences among IEC, SAE/UL, GB and JEVS. The way to compile the issued standards in different regions, however, is time consuming and may get limited helpful hints until tried and tested. Based on above-mentioned standards, this study summarized an overview in aspects of construction, function, performance and safety for charging equipments. To facilitate as a competent safety design, key requirements of electrical safety were presented. These crucial design rules included functional requirements, constructional requirements, personal protection against electric shock, insulation coordination, electromagnetic compatibility and charging control. The rationale and compliance requirements were highlighted to assist as design guidelines. In addition, learning from the past is always a good approach to build confidence to comply with the safety requirements. Based on the standards—follow most IEC and some SAE/UL—for pilot-run project in Taiwan, a case study of an AC charging stand provided the safety faults encountered and solutions in designing a new product that can meet safety requirements effectively. With these design guidelines and the case study, this paper provided a solid basis of safety design for electric vehicle charging equipments.

As the number, complexity and interaction of electrical, electronic and programmable electronic (E/E/PE) systems increase, a growing emphasis has been placed on the concept of functional safety during product development. IEC 61508 provides guidelines and standardized procedures in the development of reliable and dependable E/E/PE systems to assure functional safety. Determining risk classes (i.e., safety integrity levels, SILs) associated to a specific E/E/PE item may be recognized as one of the most crucial activities in the product development per IEC 61508 since SILs are used to specify necessary safety requirements for achieving an acceptable residual risk. This article presents a case study on the assessment of SILs applying failure modes, effects and diagnostic analysis (FMEDA) from which failure rates may be derived for each important failure category by combining a standard FMEA with online diagnostic techniques.

This paper presents the latest functional safety innovations at the power management level of a System Basis Chip (SBC), from the development phase to system design, underscoring the link to reliability and how to enable hardware that is safety ready. The presentation will also demonstrate how using architecture developed for Automotive Safety Integrity Level (ASIL) can help improve the functional robustness of an embedded system with a destructive test performed on the Integrated Circuit (IC) The experimental results show the robustness of the safety architecture and how the safe state is activated in case of destruction by an Electrical Over Stress (EOS).

Automotive engineers have to meet evolving customer expectations, particularly growing concerns for safety, by introducing new sophisticated devices like Line Keeping Assistance, Collision Mitigation Braking System or Pedestrian Detection. These devices are composed of electrical components. They are likely to be subject to failures that may impact automobile safety, which means the safety of the vehicle occupants or pedestrians. Recent standards like ISO 26262 aim at mitigating these safety problems. Automobile engineers must prove that they perform safety studies along the design process. Meanwhile, they have to cope with other changes in their engineering practices. Due to the goals of verifying the satisfaction of all requirements, the design offices have introduced new practices based on Systems Engineering (SE) which are based on models. SE tools or processes are based on a functional approach of the system in which dysfunctional aspects are missing. Thus, there is a need to integrate the safety domain into the SE framework in order to improve safety studies and the collaboration between systems engineers and safety specialists. This paper analyzes this issue by focusing on the definition of high-level (or vehicle-level) safety requirements. It proposes a Safe Systems Requirement Engineering Process and a method named Operational and System Hazard Analysis (O&SHA) that helps to specify the high-level safety requirements (called safety goals in ISO 26262). It is based on a Model-Based Systems Engineering approach (MBSE) which integrates safety aspects. The added value of the proposed method is illustrated by applying it to two case studies.

Increasing reliance on networking in modern safety-critical control systems requires novel methodologies integrating security consideration in the system development. We propose a novel approach enabling systematic derivation of both safety and security constraints from the system safety case. A safety case is a structured argument justifying system safety. We demonstrate how the decomposition of safety goals results in deriving constraints that should be imposed on the system and software behavior to guarantee safety in presence of accidental and malicious faults.

In order to perform safety assessment of vehicles for highly automated driving, it is critical that the vehicle can be proven to adapt its driving according to the sensed objects that might become a hinder. There is a complicated relation between the confidence of what hinders that might exist coming out of an environment perception block, and the tactical decisions about the driving style done by the autonomous vehicle. A good strategy that enables safety assessment according to ISO26262 implies that the environment perception block should address its safety requirements for all the ASIL attribute values simultaneously. In this paper we argue why every functional safety requirement allocated to an environment perception block should preferable be instantiated four times, each with a different ASIL value.

Safety is an essential issue for processes that present high risk for human beings and environment. An acceptable level of risk is obtained both with actions on the process itself (risk reduction) and with the use of special safety systems that switch the process into safe mode when a fault or an abnormal operation mode happens. These safety systems are today based on digital devices that communicate through digital networks. The IEC 61508 series specifies the safety requirements of all the devices that are involved in a safety function, including the communication network. Also electrical generation and distribution systems are processes that may have a significant level of risk, so the criteria stated by the IEC 61508 applies. Starting from this consideration, the paper analyzes the safety requirement for the communication network and compare them with the services of the communication protocol IEC 61850 that represents the most used protocol for automation of electrical plants. The goal of this job is to demonstrate that, from the technical point of view, IEC 61850 can be used for implementing safety-related functions, even if a formal safety certification is still missing.

This article presents a practical implementation of a safety verification framework for nuclear power plants (NPPs) based on fuzzy logic where hazard scenarios are identified in view of safety and control limits in different plant process values. Risk is estimated quantitatively and compared with safety limits in real time so that safety verification can be achieved. Fuzzy logic is used to define safety rules that map hazard condition with required safety protection in view of risk estimate. Case studies are analyzed from NPP to realize the proposed real-time safety verification framework. An automated system is developed to demonstrate the safety limit for different hazard scenarios.

The functional safety is applied to the public safety monitoring system. Based on optimized three-dimension risk matrix, the safety integrity level (SIL) of public safety monitoring system is studied. The research indicates that other independent layers of protection, as a supplementary, can safeguard the public safety monitoring system lacking of protection. The number of people in a public place is not considered in the optimized three-dimension risk matrix which causes the SIL derived from the three-dimension risk matrix to be rather backward-looking. So the number of independent protection layers or (and) the SIL of a safety function safety monitoring system should be decreased accordingly and make the individual risk is properly below the acceptable individual risk of the public safety. It is suggested that the functional safety of the public safety monitoring systems should be researched specially.

This paper describes a systematic way to apply the functional safety standards IEC 61508 and IEC 61511 on the safety management of a chemical process tank. After a short introduction of the basic principle of the functional safety philosophy the risk based determination of the safety integrity level (SIL) for a special liquid tank application is given. Then a safety instrumented system (SIS) suitable to the SIL-level 2 has been designed to fulfill the qualitative and quantitative requirements in the safety standards. The experience gained can be seen as a guidance for process and I&C engineers in industrial practice.

Safety is one of the key issues of future automotive development. With the trend of increasing functionality and complexity in automotive embedded system, there are increasing risks of functional failures. It is necessary to perform the functional safety process throughout the safety lifecycle of these systems. The appearance of the new functional safety standard ISO WD 26262 also makes the consideration of functional safety as part of the design and implementation process for these systems. This paper introduces the new standard ISO WD 26262 and analyses its features. The safety life cycle according to the new standard, activities necessary for the achievement of functional safety during the development phase are shown. An example application according to ISO WD 26262 is given and the process and methods of functional safety analysis in this example are proposed.

Safety is always the key issue in automotive industry. The adoption of hi-tech automotive applications requires not only the development of reliable electrical/electronic/programmable electronic (E/E/PE) systems and communication protocols, but also an evolution in functional safety process management. ISO/WD 26262, the adaption of IEC 61508 for road vehicles, provides guidelines and standardized measurements for functional safety. This paper discusses how automotive microcontroller suppliers can deal with this new challenge by integrating functional safety management into product design and development. An ISO/WD 26262-compliant functional safety management flow is proposed, with specifications on techniques of corresponding safety assessment.

Train control system is a safety-critical system, which requires a thorough safety testing before they are deployed. But the traditional technology of test automation is not sound for safety test of safety-critical software system because of its just aiming at the system functional requirements. Focusing on the safety requirements, this paper addresses a new method to perform safety test of safety-critical system based on safety requirement by using model-based test. The method presents safety automata to express safety properties in term of safety requirements and extract safety model from the safety requirements. It also provides a new technique for automatic generation of safety test case suite. By using the method, we have designed an automatic testing framework and developed an automatic testing platform, which has been applied to standard testing the product of train control system in term of the requirements of Ministry of railways in china, and implement effectively the functional and safety test of the product of train control system in china.

ISO 26262 - The Relevance and Importance of Qualitative and Quantitative Methods for Safety and Reliability Issues Regarding the Automotive Industry Safety and reliability are key issues of today's and future automotive developments, where the involved companies have to deal with increasing functionality and complexity of software-based car functions. New functionalities cannot only be found in the area of driver assistance - most of the new car functions are and will be safety related as for example in vehicle dynamics control or active and passive safety systems. The development and integration of those functions will strengthen the need of safe processes during the system development. The new upcoming automotive standard on functional safety (ISO 26262), which is derived from the generic functional safety standard IEC 61508 to comply with the specific needs to the application sector of E/E-systems in road vehicles, will provide guidance to avoid the increasing risks from systematic faults and random hardware faults by providing feasible processes and requirements. It is evident that aspects and methods of the safety and reliability engineering are implemented and suited methods are performed in the development process at an early stage. This is one of the requirements of the new ISO 26262, which introduces a so called automotive safety lifecycle to handle all those activities that are necessary to guarantee the functional safety of automotive E/E-systems. In the following, a brief overview of the upcoming automotive standard, its new safety life cycle and the connected activities in order to ensure functional safety for safety related systems will be given. The main aim of this paper is to show the relevance and importance of one of the major tasks within the ISO 26262: the process of the hazard analysis and risk assessment as it is currently performed in the automotive industry. With the help of an example from the automotive sector, the basic steps of this method to determine the automotive safety integrity level (ASIL) are explained. Depending on the ASIL, safety requirements need to be derived as a result of the new standard regarding safety integrity attributes. Furthermore, the connection of the automotive functional safety process with methods for qualification and quantification of safety and reliability issues will be explained in this paper. The Fault Tree Analysis will be used to exemplify one of these methods which are applied subsequent to the hazard analysis and risk assessment and which make a contribution to the validation and verification of the safety process.

Power assist systems are expected to bring many benefits in various fields, and some of them have already been introduced in the welfare and manufacturing industries. As power assist systems demand...

With the recently approved IEC 61511 and ANSI/ISA-84.00.01 standards, process industry companies are being challenged to determine the level of performance required from their safety instrumented functions (SIF) and to verify that the design, installation, operation, and maintenance employed is sufficient to ensure that the required performance is sustained until the SIF is decommissioned. As a practical matter, user companies must self-certify or user approve their SIF equipment, since they are responsible for the correct operation of the SIF in the operating environment, not just individual components as manufactured. To accomplish this, user companies need lifecycle assistance from equipment manufacturers, irrespective of hardware or software certification status related to IEC 61508. One of the best means to communicate the necessary information is via a safety manual for those involved in instrument system design installation and operation. IEC 61508 requires that equipment manufacturers provide a safety manual with any product claimed to comply with IEC 61508. Although required for product certification, it is the authors' current experience that quality and consistency in safety manuals is lacking. Part of this is due to IEC 61508 not providing a clear concise template with minimum requirements. The safety manual requirements are scattered throughout the rather complex standard. This article seeks to provide a user's perspective of what essential information is needed from equipment manufacturers to not only comply with IEC 61508, but also to provide enough information to the user of the product to allow the essential balance of reliability and safety in both SIF and instrumented protective function applications. © 2007 American Institute of Chemical Engineers Process Saf Prog 2007

This paper presents control system synthesis of providing a balance between safety and control performance according to the international standard on safety, IEC 61508. As a result, the existence of a trade-off between them is established quantitatively for the first time ever.