Search

Current safety standards for automated driving recommend the development of a safety case. This case aims to justify and critically evaluate, by means of an explicit argument and evidence, how the safety claims concerning the intended functionality of an automated driving feature are supported. However, little guidance exists on how such an argument could be developed. In this paper, the MISRA consortium proposes a state machine on which an argument concerning the safety of the intended functionality could be structured. By systematically covering the activation status of the automated driving feature within and outside the operational design domain, this state machine helps in exploring the conditions, and asserting the corresponding safety claims, under which hazardous events could be caused by the intended functionality. MISRA uses a Traffic Jam Drive feature to illustrate the application of this approach.

Automation has been changing the types and causes of hazards, and influencing the way in which users interact with complex systems, particularly challenging the notion of human control as a primary basis for hazard mitigation. In this paper, we explore this challenge and use an automotive driving example to examine the distributed nature of the driving task. We define an Enhanced Vehicle Control Model (VCM) that extends the notion of controllability and joint cognition for highly automated tasks. We apply the model to three contemporary driver assistance systems by undertaking a scenario-based evaluation. As a conceptual model, the Enhanced VCM shows potential to proactively identify the hazard causes associated with a joint cognitive control. However, to provide utility and to become an effective tool for the system analyst, an accompanying methodology is needed. This is the focus of our ongoing research.

The ethical and social implications of autonomous systems are forcing safety engineers and ethicists alike to confront new questions. This paper focuses on just one of these questions - moral responsibility - bringing together inter-disciplinary insights to an issue of growing public and regulatory concern. The central thesis is that, on a conception of moral responsibility that presupposes control, the increasing autonomy of systems prima facie diminishes the extent to which engineers and users can be considered morally responsible for system behaviour. This challenge to our normal attributions of moral responsibility as a result of autonomy has come to be known as the ‘responsibility gap’. We provide a characterisation of the moral responsibility gap, which we argue has two dimensions: causal and epistemic. At the end of the paper we highlight considerations for future work.

We present a model for structuring automotive safety arguments comprising four different, yet interrelated, layers of safety claims. The layered model is structured by the rationale behind safety requirements, their relationship to corresponding physical artefact(s) and hazardous events, the means used in their development and the environment in which safety activities are undertaken. The layered approach allows for focus and clarity in communicating and assessing the functional safety of automotive Electrical/Electronic systems, particularly in the context of the automotive standard ISO 26262.

Compliance with the automotive standard ISOa26262 requires the development of a safety case for electrical and/or electronic (E/E) systems whose malfunction has the potential to lead to an unreasonable level of risk. In order to justify freedom from unreasonable risk, a safety argument should be developed in which the safety requirements are shown to be complete and satisfied by the evidence generated from the ISOa26262 work products. However, the standard does not provide practical guidelines for how it should be developed and reviewed. More importantly, the standard does not describe how the safety argument should be evaluated in the functional safety assessment process. In this paper, we categorise and analyse the main argument structures required of a safety case and specify the relationships that exist between these structures. Particular emphasis is placed on the importance of the product-based safety rationale within the argument and the role this rationale should play in assessing functional safety. The approach is evaluated in an industrial case study. The paper concludes with a discussion of the potential benefits and challenges of structured safety arguments for evaluating the rationale, assumptions and evidence put forward when claiming compliance with ISOa26262.

Presents a collection of slides covering the following topics: in-wheel motors; risk management; ISO 26262 standards; automotive engineering: hazards: driver controls and safety.

In the automotive domain the standard ISO 26262 places significant emphasis on the assignment of Automotive Safety Integrity Levels (ASILs). In particular much of Part 3 of the standard is dedicated to the process that determines the three factors that contribute to the final assigned ASIL value: exposure, severity and controllability. In this paper we examine some of the issues that the authors have encountered during the development of an in-wheel electric motor and will argue that the perceived emphasis on ASIL ratings, in the context of developing a safe system, is misplaced and potentially counterproductive. (8 pages)

This paper presents a case study that applies ISO 26262 Part 3 to the hazard analysis of an in-wheel electric motor. It describes the activities undertaken, their mapping onto the Standard, and discusses the limits and strengths of the analysis and possible alternative approaches. (8 pages)