Search

It is important to sufficiently guarantee an automotive system's safety, because otherwise terrible consequences may happen. Generally the safety in an automotive system includes two aspects: reliability and timeliness. Previous studies have proposed many approaches to how to improve them. However, few of them consider the development cost along with their improvement. In this study, we aim to propose a method that can build a safety-guaranteed and development cost-minimized schedule for functionality modeled as a directed acyclic graph running on an automotive system. Unlike previous studies that tightly couple the development cost minimization with other requirements together, we start by building a schedule with the minimum development cost by ignoring safety requirement. Then, reliability and real-time requirements are subsequently taken into consideration. Together with automotive safety integrity level decomposition options provided by International Standard called ISO 26262, the decomposition is evaluated for each task to improve its safety, and tasks are then successively chosen to adjust the schedule, such that its safety can be maximized with incurring the least extra development cost. This procedure continues until a schedule that meets safety requirement is built. Experiments on a real-life automotive benchmark and extensive synthetic functionality demonstrate that our proposed heuristics outperform the state-of-the-art heuristic algorithm, and a typical intelligent optimization algorithm.

The spread of connected vehicles is expected to multiply the effects of the growing penetration of cyberspace in our life, and with this it remarkably influences the vulnerability of society to cyberattacks in an unfavorable way. Accordingly, ZalalZone - the Hungarian test track - has set up a working group to support the necessary methodological background for cybersecurity-related validation processes for the automotive industry. Therefore the paper aims to reconsider safety integrity levels in the automotive industry related to the field of cybersecurity. Following this, the article provides a comprehensive structure of integrity levels that serves the safety requirements of nowadays new cybersecurity challenges. To adapt the new cybersecurity integrity level architecture to the conventional automotive safety integrity level framework, the authors have verified a specific clustering model. To validate the aggregated probability of the possible cyberattack alternatives, the generated new cybersecurity rating scale is compared with the ASIL probability values by applying the Kolmogorov-Smirnov test. In the final step of the analysis, the possible practical application of the new framework is presented based on the identification of the derived probability value in the case of the investigated failure mode.

This article proposes an automotive safety integrity level (ASIL) D, which is the highest automotive integrity level specified in ISO 26262, and a target application processor for driving automation systems with a high convolutional neural network (CNN) processing performance of 60.4 trillion operations per second (TOPS) with high power efficiency of 13.8 TOPS/W. To achieve both performance and power efficiency, a stream processing architecture specialized for CNN hardware module is adopted to implement many low-power arithmetic units. In addition, 6 MB of local memories are implemented to reduce data transfers between dynamic random access memory (DRAM) and the CNN hardware, thereby improving the execution efficiency of the arithmetic units and saving power consumption caused by the data transfer. In order to support high safety integrity level with power efficiency, we provide safety mechanisms with high failure detection rates only for the hardware used in applications that require ASIL D support. The configuration of two CNN modules can switch between lockstep and single operation depending on the use case, thus achieving a tradeoff between performance and ASIL while maintaining power efficiency. In addition, the freedom from interference (FFI) concept defined in ISO 26262 is achieved by providing mechanisms to prevent low safety level tasks from interfering with high safety level tasks running concurrently inside the processor.

Safety-critical systems such as Advanced Driving Assistance Systems and Autonomous Vehicles require redundancy to satisfy their safety requirements and to be classified as fail-operational. Introducing redundancy in a system with high data rates and processing requirements also has a great impact on architectural design decisions. The current self-driving vehicle prototypes do not use a standardized system architecture but base their design on existing vehicles and the available components. In this work, we provide a novel analysis framework that allows us to qualitatively and quantitatively evaluate an in-vehicle architecture topology and compare it with others.With this framework, we evaluate different variants of two common topologies: domain and zone-based architectures. Each topology is evaluated in terms of total cost, failure probability, total communication cable length, communication load distribution, and functional load distribution.We introduce redundancy in selected parts of the systems using our automated process provided in the framework, in a safety-oriented design process that enables the ISO26262 Automotive Safety Integrity Level decomposition technique. After every design step, the architecture is re-evaluated. The advantages and disadvantages of the different architecture variants are evaluated to guide the designer towards the choice of correct architecture, with a focus on the introduction of redundancy.

In today's automotive ICs, online safety checking is often required in order to achieve a high Automotive Safety Integrity Level (ASIL). For a Delay-Locked Loop (DLL), the most important safety (or health) indicator is the “phase error between the input clock signal and the output clock signal”. In this paper, we present a phase error monitoring scheme for DLLs, using circuits made of only standard cells. The proposed scheme can monitor the phase error continuously to record its worst-case values during a designated monitoring session. As a result, hazardous phase error glitches can be exposed and an alarm can be raised. We have implemented this monitoring scheme for a Delay Lock Loop in a 90 nm CMOS process and post-layout simulation is conducted to verify its effectiveness. Experimental results show that it can help expose hazards induced by dynamic power glitches that occurs within 1ns.

The present study proposes a method that numerically quantifies automotive safety integrity level (ASIL). Additionally, the method reduces the uncertainty in the risk estimation step by subdividing the ASIL step by applying fuzzy theory to reduce the ambiguity of ASIL with an extremely wide step. The conventional risk-based design concept is adopted to quantify ASIL, and fuzzy modeling is used to express the vehicle safety integrity ratings of uncertain automotive electrical equipment. To overcome the uncertainty, we fuzzify the variable using the mean expected value method and select the trapezoidal fuzzy number. The final fuzzy output is generated using Mamdani’s method with 25 fuzzy rules combined with variables to obtain risk. This theory provides a useful approach for overcoming the inherent uncertainty in ASIL. We attempt to establish the effectiveness of the proposed method by utilizing it to quantify the automatic emergency-braking device scenario, which is a typical target system.

The increasing use of lithium batteries and the necessary integration of battery management systems (BMS) has led international standards to demand functional safety in electromobility applications, with a special focus on electric vehicles. This work covers the complete design of an enhanced automotive BMS with functional safety from the concept phase to verification activities. Firstly, a detailed analysis of the intrinsic hazards of lithium-based batteries is performed. Secondly, a hazard and risk assessment of an automotive lithium-based battery is carried out to address the specific risks deriving from the automotive application and the safety goals to be fulfilled to keep it under control. Safety goals lead to the technical safety requirements for the next hardware design and prototyping of a BMS Slave. Finally, the failure rate of the BMS Slave is assessed to verify the compliance of the developed enhanced BMS Slave with the functional safety Automotive Safety Integrity Level (ASIL) C. This paper contributes the design methodology of a BMS complying with ISO 26262 functional safety standard requirements for automotive lithium-based batteries.

Development in the field of Single Board Computers (SBC) have been increasing for several years. They provide a good balance between computing performance and power consumption which is usually required for mobile platforms, like application in vehicles for Advanced Driver Assistance Systems (ADAS) and Autonomous Driving (AD). However, there is an ever-increasing need of more powerful and efficient SBCs which can run power intensive Deep Neural Networks (DNNs) in real-time and can also satisfy necessary functional safety requirements such as Automotive Safety Integrity Level (ASIL). ProAI is being developed by ZF mainly to run powerful and efficient applications such as multitask DNNs and on top of that it also has the required safety certification for AD. In this work, we compare and discuss state of the art SBC on the basis of power intensive multitask DNN architecture called Multitask-CenterNet with respect to performance measures such as, FPS and power efficiency. As an automotive supercomputer, ProAI delivers an excellent combination of performance and efficiency, managing nearly twice the number of FPS per watt than a modern workstation laptop and almost four times compared to the Jetson Nano. Furthermore, it was also shown that there is still power in reserve for further and more complex tasks on the ProAI, based on the CPU and GPU utilization during the benchmark., Comment: Accepted by IEEE International Conference on Computer Vision (ICCV) 2021

Automotive cyber-physical systems (ACPS) are typical cyber-physical systems because of the joint interaction between the cyber part and physical part. Functional safety requirement (including response time and reliability requirements) for an ACPS function must be assured for safe driving. Auto industry is cost-sensitive, power-sensitive, and environment-friendly. Energy consumption affects the development efficiency of the ACPS and the living environment of people. This paper solves the problem of optimizing the energy consumption for an ACPS function while assuring its functional safety requirement (i.e., energy-efficient functional safety for ACPS). However, implementing minimum response time, maximum reliability, and minimum energy consumption is a conflicting problem. Consequently, solving the problem is a challenge. In this paper, we propose a three-stage design process toward energy-efficient functional safety for ACPS. The topic problem is divided into three sub-problems, namely, response time requirement verification (first stage), functional safety requirement verification (second stage), and functional safety-critical energy consumption optimization (third stage). The proposed energy-efficient functional safety design methodology is implemented by using automotive safety integrity level decomposition, which is defined in the ACPS functional safety standard ISO 26262. Experiments with real-life and synthetic ACPS functions reveal the advantages of the proposed design methodology toward energy-efficient functional safety for ACPS compared with state-of-the-art algorithms.

Embedded systems-on-chip SoC, safety processors, and virtual machines are the developing opportunities in the vehicular embedded system. The embedded technology must adhere to the automotive safety ISO26262 standard. SoC functional safety offers to ensure we meet the expectations in the ISO26262 ASIL automotive safety integrity level.

Field-Programmable Gate Arrays (FPGAs) provide a cutting-edge platform for meeting the performance, cost, dependability, and flexibility requirements of on-board data processing in mission-critical and safety applications. However, commercial off-the-shelf SRAM-based FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). The detection and mitigation of SEUs is, therefore of paramount significance. SEU mitigation techniques such as Triple Modular Redundancy (TMR) and configuration scrubbing are well known. However, these techniques either provide high resource overheads or utilize resources that are themselves susceptible to SEUs. In this work, we propose a Lightweight and Fully Testable SEU Mitigation system–LFTSM that combines high-speed Xilinx FPGA internal configuration repair mechanism with a robust external scrubber in processor cores, targeting SEUs in SRAM-based Xilinx SoC FPGAs (Zynq). The internal repair mechanism corrects single-bit upsets and notifies external scrubber when multi-bit upsets are detected. Multi-bit upsets are classified and repaired by the external scrubber. Our proposed LFTSM system aims to achieve reliability in resource-intensive FPGA application systems providing minimal resource utilization with less than 1% resource overheads (on XC7Z020 FPGA) and the widest fault coverage. Our system provides the smallest resource utilization in comparison to other solutions in the literature and offers full testing control in compliance with Automotive Safety Integrity Level (ASIL); a risk classification standard defined by the ISO 26262. Our solution neither requires the usage of external memories nor third-party tools. We implemented the LFTSM system on Xilinx Zynq SoC (with XC7Z020 FPGA). We validated the fault detection efficiencies of our design using fault injection testing with complete control over the number and locations of error injections in the configuration memory. For the XC7Z020 device, LFTSM scans all configuration bits in multiple microseconds, detects upsets within 8ms and then corrects single-bit and multi-bit upsets in further few milliseconds. We successfully integrated and tested the proposed LFTSM system with the industrial resource-hungry application systems for automotive.

Autonomous vehicles use cyber-physical systems to provide comfort and safety to passengers. Design of safety mechanisms for such systems is hindered by the growing quantity and complexity of SoCs (System-on-a-Chip) and software stacks required for autonomous operation. Our study tackles two challenges: (1) fault handling in an autonomous driving system distributed across multiple processing cores and SoCs, and (2) isolation of multiple software modules consolidated in one SoC. To address the first challenge, we extend the state-of-the-art E-Gas layered monitoring concept. Similar to E-Gas, our safety mechanism has function, controller and vehicle layers. We propose to distribute these safety layers on processors with different ASILs (Automotive Safety Integrity Level). Besides, we implement seif-test, fault injection and challenge-response protocols to detect faults at runtime in the safety mechanism itself. To facilitate distributed operation, our mechanism is built on top of the DDS (Data Distribution Service) software middleware for safety-critical embedded applications, as well as DDS-XRCE (eXtremely Resource Constrained Environment) for resource- constrained processor cores of the highest ASIL. To address the second challenge, our safety mechanism employs hardware- assisted hypervisors to isolate software modules and implement fail-silent behavior of faulty software stacks. We validate our safety mechanism on the NXP BiueBox hardware platform using the LG SVL simulator, Baidu Apollo software framework for autonomous driving, and Xen hypervisor. Our fault injection experiments demonstrate that the distributed safety mechanism successfully detects faults in an autonomous system and safely stops the vehicle when necessary.

Classical decentralized architectures based on large networks of microprocessor-based Electronic Control Units (ECU), namely those used in self-driving cars and other highly-automated applications used in the automotive industry, are becoming more and more complex. These new, high computational power demand applications are constrained by limits on energy consumption, weight, and size of the embedded components. The adoption of new embedded centralized electrical/electronic (E/E) architectures based on dynamically reconfigurable hardware represents a new possibility to tackle these challenges. However, they also raise concerns and questions about their safety. Hence, an appropriate evaluation must be performed to guarantee that safety requirements resulting from an Automotive Safety Integrity Level (ASIL) according to the standard ISO 26262 are met. In this paper, a methodology for the evaluation of dynamically reconfigurable systems based on centralized architectures is presented. The aim is to evaluate the reliability and probability of failure while exploring the design space without compromise the overall system performance. The methodology is divided into three stages. In the first stage, the system is decomposed, and its sub-systems are isolated before applying a Fault Tree Analysis on the elements of each sub-system. The mathematical stochastic model of Markov Chain is used in the second stage to obtain the reliability function and the quantification of the Mean Time to Failure (MTTF) of the system. Finally, the overall system is evaluated in terms of performance, and according to time constraints such as reconfiguration latency in case of failure. Applying this method, we quantify the MTTF in Failure in Time (FIT) format of an E/E architecture. Additionally, we evaluate each sub-system independently and obtain the respective ASIL decomposition of the overall system. The aim is to evaluate the migration of safety-related functionalities/redundancy from traditional architectures into reprogrammable devices. With the application of this methodology, we can evaluate the reliability and performance of dynamically reconfigurable systems and define new E/E automotive architectures.

Component-based approaches and software product lines have been adopted by industry to manage the diversity of configurations on safety-critical software. Safety certification demands compliance with standards. ISO 26262 standard uses the concept of Automotive Safety Integrity Level (ASIL) to allocate safety requirements to components of a system under design. Compliance with standards is demonstrated through achieving those ASILs which can be very expensive when requirements are high. While achieving safety certification of variant-intensive components without being unnecessarily stringent or expensive is desirable for economy, it poses challenges to safety engineering. In this paper, we propose an approach to manage the diversity of safety goals and supporting safety certification of software components. Our approach is built upon the integration among ASIL decomposition, software process modeling, and variability management techniques. The approach supports cost-effective safety certification and the efficient tailoring of process models to components according to their ASILs. We evaluated our approach in the automotive domain. The approach is feasible in supporting the management of the diversity of safety goals, and cost-effective safety certification of software components.

Radar is currently employed in automotive applications to provide the range, angle, and velocity of objects using RF waves (77GHz). This paper outlines solder joint reliability of a specific micro-processor that processes data received from a SRR (short range radar operating from 0.2 to 30 meters). It is a powerful digital signal processing accelerator, which targets safety applications that require a high Automotive Safety Integrity Level (ASIL-B). The paper explores the package design and construction, SMT (surface mount technology) assembly, and board level reliability testing of various BGA pad surface finish and solder ball alloy materials on a 0.65 mm pitch, 10 × 10 mm body 141 MAPBGA (mold array process-ball grid array) package. The package configurations include two BGA pad surface finishes (Ni/Au and OSP [organic solderability protectant]) and three solder alloys (SnAg, SAC405, and SAC-Bi [a Bi containing SAC derivative]). Solder joint reliability analysis was performed through AATS (air-to-air thermal shock) between 40°C and +125°C and JEDEC Drop Testing at 1500G's. Thermal shock was extended until at least 75% of the populations failed, which was well past the points needed to qualify the packages for the intended end-use applications. The evaluations of the micro-processor indicate that the MAPBGA package can meet the ASIL-B specification requirements with optimized combinations of BGA pad surface finish and solder alloy. The focus of this paper was to determine the baseline solder-joint thermal shock and JEDEC drop performance with varied BGA pad surface finish and solder ball alloy materials.

ISO 26262 is a functional safety standard specifically made for automotive systems, in which the automotive safety integrity level (ASIL) is the representation of the criticality level. Recently, most studies have used ASIL decomposition to reduce the development cost of automotive functions. However, these studies have not paid special attention to the problem that the reliability goal may not be satisfied when ASIL decomposition is performed. In this study, we solve the problem of minimizing the development cost of a distributed automotive function while satisfying its reliability goal during the design phase by presenting two heuristic algorithms, reliabilitycalculation of scheme (RCS) and minimizing development cost with reliability goal (MDCRG). We first use RCS to calculate the reliability value of each ASIL decomposition scheme; then, the MDCRG is used to select the scheme with the minimum development cost while satisfying the reliability goal. Real-life benchmark and simulated functions based on real parameter values are used in experiments, and results show the effectiveness of the proposed algorithms.

Hazard Analysis and Risk Assessment (HARA) in various domains like automotive, aviation, and process industry suffers from the issues of validity and reliability. While there has been an increasing appreciation of this subject, there have been limited approaches to overcome these issues. In the automotive domain, HARA is influenced by the ISO 26262 international standard which details functional safety of road vehicles. While ISO 26262 was a major step towards analysing hazards and risks, like other domains, it is also plagued by the issues of reliability. In this paper, the authors discuss the automotive HARA process. While exposing the reliability challenges of the HARA process detailed by the standard, the authors present an approach to overcome the reliability issues. The approach is obtained by creating a rule-set for automotive HARA to determine the Automotive Safety Integrity Level (ASIL) by parametrizing the individual components of an automotive HARA, i.e., severity, exposure and controllability. The initial rule-set was put to test by conducting a workshop involving international functional safety experts as participants in an experiment where rules were provided for severity and controllability ratings. Based on the qualitative results of the experiments, the rule-set was re-calibrated. The proposed HARA approach by the creation of a rule-set demonstrated reduction in variation. However, the caveat lies in the fact that the rule-set needs to be exhaustive or sufficiently explained in order to avoid any degree of subjective interpretation which is a source of variation and unreliability.

An important issue concerning the use of safety standards in the design of a complex system is the proper evaluation of the risks. The risk is correlated to the probability of failure, then to the failure rate, and it plays a fundamental role in the safety assessment process. This paper focuses on the failure rate evaluation methods adopted by the following functional safety standards: ISO 19014, ISO 25119, and IEC 61508. All of these standards are applicable, respectively, in the earth-moving machinery, in the tractors and machinery for agriculture and forestry, and in the industrial automation fields. As proposed by the standards, the failure rate evaluation depends on the conventional parameters like Mean Time To Failure, Diagnostic Coverage level, and Hardware Categories. Nevertheless, assuming the same value of these parameters, the results obtained adopting the suggested methods from different standards are not always the same. The aim of this paper is to give an analytical approach to calculate, on a common basis, the failure rate starting from a certain set of input parameters. In addition, the approximations are analysed in order to identify the correct assumptions for the proper application of all these “not exact” values in each application field.

ISO 26262, the new automotive functional safety standard, aims to foster the design and development of safe products by ensuring that the risks posed by hazardous components are reduced to a residual level. Therefore, the standard defines and uses the concept of Automotive Safety Integrity Levels (ASILs) that classify the strictness of safety requirements to be assigned to the failure modes of the system based on the hazard they may cause. ASIL allocation can be described as a hard optimization problem focused on finding the optimal ASIL allocation that maximizes the safety requirements and minimizes cost. However, finding this optimal allocation among a set of possible allocations can represent a difficult task in large systems that contain a large number of components, which subsequently increases the search space. In this paper, we introduce a novel approach that uses the nature-inspired meta-heuristic Ant Colony Optimization (ACO) algorithm to solve the ASIL allocation problem and makes use of strategies that reduce the solution space. The problem was formulated as a construction graph, which the ants use to construct possible ASIL allocations. The search space reduction is accelerated considerably by both the effective performance of the ACO and the convergence of the algorithm on the optimal solution. This approach has been evaluated by applying it to a hybrid braking system and a steer-by-wire system. The results show a significant improvement over genetic-based, penguins search-based and tabu search-based approaches.

Future generations of automobiles (also known as cybercars) will further increase the proliferation of electronic control units (ECUs) to contrive novel infotainment and distributed control applications. International Organization for Standardization (ISO) 26262 is an automotive standard that designates automotive safety integrity levels (ASILs) to indicate the criticality associated with a function. This article aims to provide a concise discussion on the safety assessment and design of dependable cybercars considering the current state of the art and future perspectives. I will elaborate on the risk assessment and design of dependable cybercars as stipulated in ISO 26262 and classify failure modes in cybercars and the methods to assess these failures. I will also discuss various hardware architectural metrics to assess safety and dependability of a cybercar design as well as various research challenges and future research directions for realizing safe and dependable cybercars.

The released ISO 26262 standard for automotive systems requires to create a hazard analysis and risk assessment and to create safety goals, to break down these safety goals into functional safety requirements in the functional safety concept, to specify technical safety requirements in the safety requirements specification, and to perform several validation and verification activities. Experience shows that the definition of technical safety requirements and the planning and execution of validation and verification activities has to be done jointly by OEMs and suppliers. In this paper, we present a structured and model-based safety development approach for automotive systems. The different steps are based on Jackson's requirement engineering. The elements are represented by UML notation extended with stereotypes. The UML model enables a rigorous validation of several constraints. We make use of the results of previously published work to be able to focus on the OEM/supplier interface. We illustrate our method using a three-wheeled-tilting control system (3WTC) as running example and case study.

It is getting mandatory to comply with ISO26262 in the recent automotive development. The implementation of safety mechanism to detect faults is one of the keys in ISO26262. The fault prediction will make the automotive system more reliable. The SoC in this paper introduces two features: hardware built-in self-test (BIST) for safety mechanism supporting automotive safety integrity level (ASIL) B and killer-droop monitor for fault prediction. In addition, time slicing is introduced to the testing with hardware BIST during runtime so that each test session can be shorter than the required interrupt response time in the application. The killer-droop monitor can predict the voltage droop and stop the clock supply for a certain period of time to mitigate the droop for preventing delay faults on the SoC. The monitor samples the voltage based on time-to-digital converter at CPU operation clock and predicts the voltage from the history of sampled voltage. With that prediction feature, the minimum operation voltage can be improved by 50 mV at 2.02 GHz CPU operation, and the maximum frequency can be improved by 140 MHz under 0.82 V power supply in 16 nm process.

ISO 26262, an automotive functional safety standard, ensures the functional safety of automotive systems by providing requirements and processes to govern the software lifecycle. Each functional system must be classified in terms of safety goals, risks, and automotive safety integrity level (ASIL: A, B, C, and D), with ASIL D, denoting the most stringent safety level. As the risk of the system increases, the ASIL level increases, and the standard highly recommends more stringent methods to ensure safety. ISO 26262 highly recommends that ASIL C and D-classified systems utilize semiformal and formal verification among other techniques to verify software unit design and implementation. In this paper, we compare industrial design verification steps of WatchDog Manager in an effort to be ASIL B-compliant with a proposed nondisruptive methodology to semiformally verify WatchDog Manager UML design via an automated formal framework backbone. This semiformal verification framework will allow automotive software to comply with ASILs C and D formal and semiformal unit design and implementation verification recommended guidelines in ISO 26262. Semiformal UML finite-state machines are automatically compiled into formal notations based on the Symbolic Analysis Laboratory formal notation. We capture requirements in the UML design and compile them automatically into theorems. Model checkers are run against the compiled formal model and theorems to detect counterexamples that violate the requirements in the UML model. We show that semi-formal verification of the design allows us to uncover issues that were detected in testing and production stages of ASIL B-compliant Watchdog Manager existing implementation.

In this paper, we base on the fault tree analysis (FTA) to propose an Automotive Safety Integrity Level (ASIL)-oriented hardware design framework for safety-critical automotive systems, where ASIL plays a key component in the ISO 26262 safety standard to measure risk of a specific system component. There are two contributions in this framework: FTA-based weak-point analysis and ASIL-oriented fault-tolerant design methodologies. The former can rapidly identify the weak-points for safety through the fault tree analysis, and the latter can effectively introduce the safety mechanisms in the hardware design to fulfill the requirements of target ASIL. We use the autonomous emergency braking (AEB) system to demonstrate the effectiveness of the proposed design framework.

Providing safety assurance for Automated Vehicle (AV) domain controllers which also complies with the growing list of functional safety standards is a challenging task. Compliance with these norms requires several steps during the safety life-cycle. A system definition is followed by the allocation of functional objectives to architectural elements. The safety analysis then includes the identification of safety goals and respective Automotive Safety Integrity Level (ASIL - injury risk) assessments as required by the desired automation level. Finally, safety mechanisms are included to provide necessary fault coverage and ensure that safe modes and states are reached in the presence of system faults. The focus of this paper is to provide a methodical definition process of a hypothetical AV domain controller architecture. Our proposed process includes an assortment of typical functional objectives and attributes consistent with the Operational Design Domain (ODD) at automation levels 3, 4 and 5. The intent of this paper will be to ensure that the safety goals and requirements are completely and correctly stated at the start of the development process and then propagated accurately to the final design and implementation with-out omission.

Electronic component is increasing in Automotive applications spanning from power train, connectivity, airbag, driver assistance, braking and more. Most of these components are Integrated Circuits that have to fulfill system safety requirements in sophisticated safety applications. A functional safety review and assessment are used to confirm whether integrated circuit component fulfills hardware safety and functional requirements derived from system safety goals. One such automotive safety system is the Airbag Control Unit with integrated Squib Drivers that deploys driver and passenger airbags when a valid car crash event is detected. Airbags are passive safety application, critical for driver and passenger safety that can be fatal if not deployed properly. Therefore, components used in airbag applications have to fulfill the highest system Automotive Safety Integrity Level (ASIL), ASIL-D. The safety critical part of Squib Driver Integrated Circuits is the High Side and Low Side powerFETs with its pre-drivers, control, monitoring, protection and diagnostics. This paper describes design Failure Mode Effect Analysis (FMEA) as one part of the systematic design methodology flow by using the low side current regulating driver as an example. This systematic approach resulted in a unique safety architecture that prevents inadvertent activation of the low side powerFET in the unpowered state of the driver. In the powered state, the current is regulated to 3A and is stable for inductances up to 3mH, a 30x higher inductive load than a traditional squib driver.

Automotive safety integrity level (ASIL) of a component decides the criticality associated with the system. This criticality involves cost and effort by original equipment manufacturers for developing the product. Since criticality increases with increase in ASIL, it is one of the major disadvantages on the part of OEMs to develop the complete system according to highest ASIL among all its components. In this paper, an efficient technique to resolve the issue of criticality by ASIL Decomposition is proposed in a detail way. In the later part of this paper, the incorporation of this technique to the automobile industry for developing an efficient system is explained using a case study.

This paper proposes a new technique for verifying the compliance of AUTOSAR software with the ISO26262 functional safety standard. A framework is presented which formally verifies that a given implemented AUTOSAR software fulfils high risk Automotive Safety Integrity Level (ASIL) C and D requirements. The framework exploits the power of symbolic execution to uncover defects early in the design stage. The efficacy of the framework is demonstrated on the AUTOSAR watchdog manager and watchdog interface modules.

Based on the GB/T 34590 functional safety standard, this paper analyzes the failure of the clutch system of a dual-motor hybrid bus and determines the Automotive Safety Integrity Level (ASIL) of different failure modes. Finally, it is confirmed that the clutch system needs to meet ASIL B. In order to achieve this level of safety, the hardware and software architecture of the clutch control system was designed, and the clutch state control and diagnostic module of the software architecture was introduced in detail. Finally, a hardware test and a software test method for system integration are described according to the safety level.

The simulation of electronic control function failure has been utilized broadly as an evaluation method when determining the Automotive Safety Integrity Level (ASIL). The driver model is quite critical in the ASIL evaluation simulation. A new driver model that can consider drivers of different driving skills is proposed in this paper. It can simulate the overall performance of different drivers driving vehicles by adjusting parameters, with which the impact of a certain electronic control function failure and the ASIL are evaluated. This paper has taken the function failure of regenerative braking as the simulation object in the double-lane-change driving scenario to simulate typical driving conditions with the designed driver model, and then has obtained the ASIL of regenerative braking function, which is applied to a BAIC new energy vehicle development project.

Safety critical system development includes a wide set of techniques, methods and tools for assuring system safety. The concept of evidence is one of the key notions used to provide safety confidence to stakeholders. Safety goals must be identified during safety analysis. In addition, risks should also be considered and managed, and linked to the achievement of safety goals. This paper proposes an extension of the ISO/IEC 24744 metamodel for development methodologies in order to integrate the management of goals, risks and evidence into system development lifecycles in an ISO/IEC 15026-compliant manner that is related to the approach of assurance cases. The proposed extension is illustrated through a real-life scenario in the automotive domain where the system being developed must comply with ISO 26262, a standard in this domain. By using the proposed approach, the management of goals, risks and evidence in critical systems development is formalized and harmonized with different ISO/IEC standards, resulting in a more robust and systematic treatment of these crucial aspects., This work was partially supported by a grant from “Programa de Movilidad del Personal Investigador del Departamento de Educación, Política Lingüística y Cultura del Gobierno Vasco” (MV_2014_1_34) and funding from the FP7 programme under grant agreement number 289011 (OPENCOSS).

During a manufacturing process of automotive clutch an explosive substance – xenon is produced. Concentration of this substance must be monitored. Implementation of controls is performed by a safety-critical functions control system.Among main role during the process of risk assessment analysis belong determination of danger and dangerous events associated with the devices. Proactive planning errors and the use of appropriate standards can greatly reduce formation disorders thereby reducing the probability of dangerous consequences. The standard safety subsystems architectures and computation methods for determining the failure intensity is listed in the standards IEC 61508 and IEC 61511. These standards contain information tables with the results of these computations for selected parameter values.We propose a complete failure probability model for the safety functions of the control system. This model is designed to compute the intensity of the critical failure for the standard channel architectures.These architectures were designed with respect to the standard IEC 61508 and were implemented in Matlab.

Safety and security aspects consist of two different group of functional requirements for the control and protection systems. In the paper it is proposed that the security analysis results can be used as a factor increasing or decreasing the risk level. It concerns a process of determining required safety integrity level of given safety functions. The authors propose a new approach for functional safety risk analysis. In this case the security factor influences the value of required safety integrity level SIL by changing the frequency of accident scenario. It can be done by using the methodology of modified risk graph. On the other hand there is a verification of required SIL fulfillment for designed safety-related system which implements safety function. In this case the result of security analysis is affecting uncertainty of probabilistic model parameters. The proposed method takes into consideration the sensitivity analysis of probabilistic models of E/E/PE or safety instrumented systems SIS as well as the uncertainty of probabilistic results. It uses differential factors, which are helpful for effective verification of required SIL of the E/E/PE or SIS systems taking into account results of sensitivity analysis and/or assessment of uncertainty ranges obtained from probabilistic models developed.

For safety-critical systems including railways, there has been a growing need for effective and systematic safety management processes. The outcomes of efforts in this area are international safety standards, such as IEC 61508, 62278, and ISO 26262. One of the principal activities in the safety process is hazard analysis. For this reason,considerable efforts have been directed toward methods of hazard analysis. On the other hand, the hazard analysis methods reported thus far appear to be unclear in terms of their relationship with the system design process. In addition, in some cases, the methods appear to rely heavily on information regarding the hardware and software components, the number of which is increasing. These aspects can become troublesome when design changes are necessary. To improve the situation, in this paper, hazard analysis was carried out using the result of functional analysis early in the concept development stage for a safety-critical system design. Because hazard analysis is carriedout at the system level and the result is then used to develop the safety requirements, improvements can be expectedin terms of the development time and cost when design changes are required due to changes in the requirements.As a case study, the generation of safety requirements for the development of light rail transit stations is presented.

Functional safety is related to the safety functions of a safety-related system that uses electrical/electronic/programmable (E/E/PE) devices such as sensors, logic solvers, and final elements. A legacy system is a safety-related system which offers safety functions but which was not designed to comply with the IEC 61508 standard. This paper presents a procedure for assessing the hardware safety integrity of a legacy system so as to confirm its functional safety. The procedure defines the systematic relationship between the safety function and hardware system using a function-structure map (FSM) and assesses the hardware safety integrity centered on the safety function. The proposed procedure is applied to a boiler control system of a fossil-fuel power plant.

Safety standards guide the development of systems whose operation raises concerns about safety. We focus our attention on the automotive and aerospace standards, ISO 26262 and ARP4754-A respectively. Both standards advocate a process for controlled allocation of safety integrity requirements that starts early in the design and continues as the system architecture is being refined. This procedure may generate a plethora of feasible design variants, all satisfying system safety requirement, but each having different allocations of integrity to components and different costs. In this paper, we describe a model-based safety analysis method for automating this allocation process in a way that cost-optimal design variants are selected. We show that the proposed method is generic and can satisfy both the automotive and aerospace safety standards with application to both industries. We apply the method using both standards on a common case study and discuss the differences in the results obtained, reflecting on the commonalities and differences between the two standards.

In this paper, we propose an electric power steering (EPS) system architecture combined with an electronic stability control (ESC) system to ensure functional safety of the EPS system. In IS026262, a standard pertaining to the functional safety of road vehicles, the Automotive Safety Integrity Level (ASIL) is classified according to the safety required for a vehicle's electrical and electronics systems. The cost and effort required during the development process to meet the high ASIL requirements have increased considerably. Therefore, we present an example application in which ASIL decomposition is used to assign a lower ASIL to the EPS system in the proposed system architecture. In addition, we validate and demonstrate the performance of the proposed functionally stable EPS system via simulation.

Advanced driver assistance system (ADAS) for autonomous driving requires high computational power. The requirement on functional safety support in ADAS SoCs is getting strict. This paper discusses two topics: implementation and verification for supporting functional safety. The SoC in this paper introduces hardware built-in self-test (BIST), hardware lock-step, and killer-droop monitor for voltage droop prediction as safety mechanism for supporting automotive safety integrity level (ASIL) B, considering area and power constraints. To verify the safety mechanisms efficiently, the hardware BIST operation is emulated by X-injection to flip-flops in RTL simulation. With this approach, the simulation verification speed can be improved by more than 50 times, compared to the gate level simulation with hardware BIST implemented gate netlist.

Existing automotive Hazard Analysis and Risk Assessment (HARA) process as discussed by the international standard ISO 26262 is static in nature. While the standard describes a systematic process to incorporate functional safety in the development process of Electrical & Electronic (E/E) systems, it fails to address the needs of Advanced Driver Assistance Systems (ADAS) and Automated Driving (AD) systems. In order to ensure the safety of ADAS and AD systems, it is important to incorporate the changing nature of interactions between the system and the environment, in the safety analysis process for ADAS and AD systems. In this paper, the authors argue the need for a dynamic approach for automotive safety analysis by adapting the tactical safety for ADAS and AD systems depending on the real-time operational capability and real-time ASIL (Automotive Safety Integrity Level) rating of a situation, and discuss a framework for this process. The novelty and therefore contribution of this paper lies in the proposed ASIL inspired dynamic tactical safety framework, which evaluates the severity, controllability and exposure ratings in real-time based on the real time values of the various vehicle and environment parameters. These ratings are used to assign a real-time ASIL value which is used to determine the tactical decisions in order to lower the ASIL value in real-time by altering the functional (operational) capability of the system. Furthermore, the framework is explained with the help of a case study based on a combined Adaptive Cruise Control (ACC) and Autonomous Emergency Braking (AEB) system.\ud

Automotive Safety Integrity Level (ASIL) decomposition is a technique presented in the ISO 26262: Road Vehicles - Functional Safety standard. Its purpose is to satisfy safety-critical requirements by decomposing them into less critical ones. This procedure requires a system-level validation, and the elements of the architecture to which the decomposed requirements are allocated must be analyzed in terms of Common-Cause Faults (CCF). In this work, we present a generic method for a bottom-up ASIL decomposition, which can be used during the development of a new product. The system architecture is described in a three-layer model, from which fault trees are generated, formed by the application, resource, and physical layers and their mappings. A CCF analysis is performed on the fault trees to verify the absence of possible common faults between the redundant elements and to validate the ASIL decomposition.

IEC 61508 standard provides a structured approach relying on hazards identification in order to establish safety requirements for safety instrumented systems (SISs). It aims at designing and operating the SIS within a reliability confidence that meets these requirements. The object of this paper is to give a concise description of IEC 61508 approach and to demonstrate it for the evaluation of safety barriers intervening against overpressure implemented on a butane storage tank. Specifically, the risk graph and layer of protection analysis approaches suggested in IEC 61508 for the determination of safety requirements are illustrated. In addition, it is shown that the use of more elaborate reliability approaches, such as fault tree and Markov graph, could be required for an effective risk assessment process. Actually, these approaches allow to consider the real configuration and operating conditions of the studied system.

This paper introduces the architecture of the power supply in order to achieve the safety integrity target for power supply which is a part of safety related system. The integrity level for safety is set 4 and according to the IEC 62425 which is standard for railway application the architecture design is conducted and process for design is developed. The procedure for design consists with 6 steps. The architecture of power supply that is able to keep the safety integrity against of failure of power supply is derived through the analysis and it is suggested that the power supply adopted the result in this paper is suitable to apply in safety system. Also, the failure frequency that is a quantitative value for the power supply is proposed.

For software-related companies to deliver safe products and to cope with emerging product liability risks, significant improvements to technology and processes are necessary. This column presents industry experiences in adapting product development to conform to safety standards.

In this paper, we propose a hardware-in-the-loop simulation (HILS) for functional safety compliant electric power steering (EPS) system. The proliferation of electric and electronic systems in vehicles has brought the new automotive standard ISO 26262 for the safety of functions. The proposed EPS system should be Automotive Safety Integrity Level (ASIL) D compliant, which is the highest ASIL level. Therefore, EPS system complies with functional safety and HILS is configured to verify performance of functional safety compliant EPS system.