Search

Safety-critical systems such as Advanced Driving Assistance Systems and Autonomous Vehicles require redundancy to satisfy their safety requirements and to be classified as fail-operational. Introducing redundancy in a system with high data rates and processing requirements also has a great impact on architectural design decisions. The current self-driving vehicle prototypes do not use a standardized system architecture but base their design on existing vehicles and the available components. In this work, we provide a novel analysis framework that allows us to qualitatively and quantitatively evaluate an in-vehicle architecture topology and compare it with others.With this framework, we evaluate different variants of two common topologies: domain and zone-based architectures. Each topology is evaluated in terms of total cost, failure probability, total communication cable length, communication load distribution, and functional load distribution.We introduce redundancy in selected parts of the systems using our automated process provided in the framework, in a safety-oriented design process that enables the ISO26262 Automotive Safety Integrity Level decomposition technique. After every design step, the architecture is re-evaluated. The advantages and disadvantages of the different architecture variants are evaluated to guide the designer towards the choice of correct architecture, with a focus on the introduction of redundancy.

Future automotive systems, with Advanced Driving Assistance Systems and Autonomous Driving functionalities, will require fail-operational electronic systems. To achieve that, redundancy is a necessary technique, like in many other fields such as aviation. Moreover the applications have different safety requirements, from safety-critical related applications, for example for the driver replacement domain, to QoS-oriented applications, for example for the infotainment domain. Redundancy in mixed-criticality systems can be solved by physically separating system resources or by using isolated virtualized environments with e.g. hypervisors. There are costs associated to both solutions. In this work we describe a novel model we use to characterize a mixed-criticality automotive system and the analysis steps to obtain quantified metrics. The quantified metrics include cost, failure probability, total functional and communication loads, and total cable length, to compare the different solutions from a system-level perspective. We analyse the same set of mixed-criticality applications that represent a simplified automotive system in four scenarios. The architecture topology is either domain-based or zone-based, and we use either physical separation or virtualization to provide isolation. The obtained results show how the model and the analysis allows us to understand the trade-offs between the different solutions in specific applications scenarios, and how to vary the metrics used in the analysis to adapt to a different applications scenario.

The Automotive industry is evolving towards a more electronics-assisted driving and self-driving functionality. The addition of complex subsystems has a great impact on the current vehicle architectures, leading to safety concerns. In this work we present a technique that follows the ISO 26262: Road Vehicles-Functional Safety standard to introduce redundancy in the architecture by using ASIL decomposition, and perform a safety analysis of the modelled system. A three-layer model is used to describe the application, the resources, and the physical space of the vehicle. In this paper we introduce novel model transformations to replicate parts of the application following ASIL decomposition rules. Finally, we perform a cost analysis and a probabilistic fault tree analysis on the architecture, making a comparison between different possible solutions. The advantages of these techniques, such as traceability and scalability, are shown by modelling and analysing the lateral control application of a real truck platooning system.

International audience; In ISO-26262, the Automotive safety integrity level (ASIL) represents the degree of rigour that should be applied in the development, implementation and verification of a requirement in order to reduce and control the risk in the final product. The ASILs are allocated to the safety requirements which are inherited by the subsystems and components in a hierarchical approach. During the allocation process, the safety requirements could be decomposed over redundant elements. It is referred to as ASIL decomposition and is an important feature, as it helps to reduce the complexity and the development cost of the design. The decomposition could lead, however, to different allocations. In this paper, we propose an approach to find all the possible allocations in order to assist the analyst in reaching the optimal allocation.