Search Results

Hazard analysis plays an important role in the development of safety-critical systems. Hazard analysis techniques have been used in the development of conventional automotive systems. However, as future automotive systems become more sophisticated in functionality, design, and applied technology, the need for a more comprehensive hazard analysis approach has arisen. In this paper, we describe a comprehensive hazard analysis approach for system safety programs. This comprehensive approach involves applying a number of hazard analysis techniques and then integrating their results. This comprehensive approach attempts to overcome the narrower scope of individual techniques while obtaining the benefits of all of them.

Steer-by-wire and other “by-wire” systems (as defined in the paper) offer many passive and active safety advantages. To help ensure these advantages are achieved, a comprehensive system-safety process should be followed. In this paper, we review standard elements of system safety processes that are widely applied in several industries and describe the main elements of our proposed analysis process for by-wire systems. The process steps include: (i) creating a program plan to act as a blueprint for the process, (ii) performing a variety of hazard analysis and risk assessment tasks as specified in the program plan, (iii) designing and verifying a set of hazard controls that help mitigate risk, and (iv) summarizing the findings. Vehicle manufacturers and suppliers need to work together to create and follow such a process. A distinguishing feature of the process is the explicit linking of hazard controls to the hazards they cover, permitting coverage-based risk assessment.

ASIL decomposition is a method described in the ISO 26262 standard for the assignment of ASILs to redundant requirements. Although ASIL decomposition appears to have similar intent to the hardware fault tolerance concept of IEC 61508-2, ASIL decomposition is not intended to reduce ASIL assignments to hardware elements for random hardware failures, but instead focuses on functions and requirements in the context of systematic failures. Based on our participation in the development of the standard, the method has been applied in different ways in practice, not all of which are fully consistent with the intent of the standard. Two potential reasons that may result in the use of “modified” ASIL algebra include the need of OEMs to partition a system and specify subsystem requirements to suppliers and the need for designers to construct systems bottom up.

In this paper, we review existing software safety standards, guidelines, and other software safety documents. Common software safety elements from these documents are identified. We then describe an adaptable software safety process for automotive safety-critical systems based on these common elements. The process specifies high-level requirements and recommended methods for satisfying the requirements. In addition, we describe how the proposed process may be integrated into a proposed system safety process, and how it may be integrated with an existing software development process.

This paper discusses the development and application of a closed-loop co-simulation platform for a controlled chassis system. The platform is comprised of several software packages, including CarSim®(MSC Corporation), AmeSim®(ImaGine Software Corporation), MATLAB®/SIMULINK®(Mathworks Corporation). The platform provides the ability to quickly evaluate enhancements to existing algorithms and to evaluate new control or diagnostic concepts, making it a rapid medium for development, testing and validation. The co-simulation platform was configured with real vehicle calibration data and used to test the validity/limitations of a simple model-based sensor diagnostics strategy. Using this approach, it was possible to quickly check for performance issues and consider needed corrections or enhancements without incurring the time and cost burden associated with in-vehicle testing.

Embedded controllers and digital signal processors are increasingly being used in automotive safety critical control systems. Controller integrity is a significant concern in these systems. Over the past decade, several techniques have been published about controller safety and integrity verification. These techniques include: single processor with watchdog, dual processors, dual core processor, and asymmetric processor (intelligent watchdog). Each of these techniques have benefits, however, many new non-distributed safety-critical systems are applying the asymmetric processor technique to help verify controller integrity. This paper discusses an overview of five controller integrity techniques, and then provides a detailed discussion of an asymmetric processor approach. This paper presents two different options within the asymmetric processor approach.

Execution of a software safety program is an accepted best practice to help verify that potential software hazards are identified and their associated risks are mitigated. Successful execution of a software safety program involves selecting and applying effective analysis methods and tasks that are appropriate for the specific needs of the development project and that satisfy software safety program requirements. This paper describes the effective application of a set of software safety methods and tasks that satisfy software safety program requirements for many applications. A key element of this approach is a tightly coupled fault tree analysis and failure modes and effects analysis. The approach has been successfully applied to several automotive embedded control systems with positive results.

A new generation of software-controlled vehicle systems promises to help enhance vehicle safety, performance and comfort. As these new, often complex systems are added, system safety programs are followed to help eliminate potential hazards. An important part of planning for a safety program is to understand applicable standards. This paper identifies, reviews, categorizes, and summarizes the importance of several applicable standards for incorporation in a system safety program.

A requirement of many modern safety-critical automotive applications is to provide failsafe operation. Several analysis methods are available to help confirm that automotive safety-critical systems are designed properly and operate as intended to prevent potential hazards from occurring in the event of system failures. One element of safety-critical system design is to help verify that the software and microcontroller are operating correctly. The task of incorporating failsafe capability within an embedded microcontroller design may be achieved via hardware or software techniques. This paper surveys software failsafe techniques that are available for application within a microcontroller design suitable for use with safety-critical automotive systems. Safety analysis techniques are discussed in terms of how to identify adequate failsafe coverage.