Concept phase in functional safety (ISO 26262, part 3)

The term “item” denotes the subject of development, your product. These are one or more interacting electrical and/or electronic systems that implement the desired function. Examples of items are automatic cruise control systems, airbags or electrical components as simple as a car window mechanism, which for example can trap an arm or head. Developing the item means that different kinds of requirements and boundary conditions have to be put together, be they functional requirements, normative references or the performance of the involved actuators in the vehicle. It is also important that you agree on what lies outside the item, that is to know the boundary.

Let us continue with the impact analysis. This is our second topic. An impact analysis shows how the lifecycle should be adjusted, tailored, and which safety activities are necessary. It must be known whether the item is a new development, a modification or just the use of a previously developed item in a modified environment, for example an airbag in a new vehicle variant. Now, in the safety lifecycle, this primarily refers to the carmaker and the vehicle level, but all suppliers should carry out an impact analysis for their area of responsibility.

Our third topic is about understanding the risks posed by our product. The risk to human life, which is in our item, has to be estimated. Note that this is typically an activity to be performed by the carmaker. Depending on this risk assessment, more and sometimes less must be done technically and in organisational terms. The “hazard analysis and risk assessment” (“HARA”) begins with a description of operational situations and operating modes, for example “driving on a highway”. The hazards that arise in the event of faults in our item are determined. For instance, a lane-keeping assist system could accidentally steer the vehicle onto the other side of the road. The “automotive safety integrity level”, or “ASIL”, is then determined for the relevant hazardous events. This ASIL has a significant influence on development activities and the product.

To do this, you determine the “Severity” of harm, the probability of “Exposure” to the operational situation and the “Controllability”, or ability to avoid harm. Once you have done that, you determine the ASIL.

For example, faulty steering by the lane-keeping assist system – into the oncoming lane – could be classified as ASIL D, as this can lead to serious injury. In contrast, incorrectly displaying a recognised traffic sign is less critical, because by itself, a traffic sign recognition system does not interfere with vehicle operation and the driver generally reacts appropriately. Once you have carried out these assessments, you write down “safety goals” for further development. Safety goals are high-level safety requirements that are suitable for mitigating hazardous events.

The fourth topic in the concept phase is the “functional safety concept”. It is about deriving functional safety requirements (“FSRs”) from the safety goals. This is where requirements for avoiding, detecting, and controlling faults are developed. A “safe state” is defined, into which the system changes in the event of an error, or which degraded state should be entered if the safe state cannot be reached immediately. Driver warnings are defined, to be displayed in the event of an error.

Requirements must be assigned so that they either get implemented in the system architecture or get implemented by external measures. The functional safety concept must be verified to determine whether it’s suitable to adequately mitigate the hazards.