ISO 26262 Part 3.7: Functional safety concept (FSC) - Detailed Explanation (Part 2/3)
Previous related blog: EmbeddedInEmbedded: ISO 26262 Part 3.7: Functional safety concept (FSC...
Functional Safety Concepts:
- The Functional Safety Concepts refers to the mapping/derivation of FSRs for following types of Architectural Elements or sources
- E/E Systems
- Systems of Other Technologies
- External Measures
Elements of E/E Systems:
ISO 26262-3:2017(E) – Clause 7.4.2.8 :
*** Please refer this clause from originally procured licensed copy of ISO26262 Part 3***
- The mapping of each FSR derived to a module (Architectural Elements like System/ Sub-System) can be termed as Functional Safety Concept. Apart from mapping ASIL allocation and other steps are also done in the FSC.
- Each Safety Goal has an ASIL level. Based upon these ASIL level shall be assigned to each FSR considering other factors as below.
- The ASIL allocated to Safety Goal is assigned to FSR. In case ASIL decomposition needs to be done further analysis has to be carried out.
- Incase multiple FSR with different ASIL levels are assigned to a single Architectural Element, then the highest ASIL is assigned. Incase different ASIL levels needs to be assigned, freedom from interference analysis can be done to assign the ASIL levels.
- If the Item has one or more E/E systems, then the FSR should be written for each of the E/E Systems and Interfaces within them.
Elements of Other Technologies:
ISO 26262-3:2017(E) – Clause 7.4.2.9 :
*** Please refer this clause from originally procured licensed copy of ISO26262 Part 3***
- FSRs implemented by elements of other technologies shall be determined and allocated to these elements.
- FSRs implemented by interfaces between elements of other technologies and elements of the E/E systems shall be specified.
- Ensuring the implementation of FSRs by elements of other technologies is not under scope of ISO 26262.
- No ASIL level should be allocated FSRs related to these elements.
- An example of other technologies in ABS system can be the Master Cylinder, Accumulators etc. which are based upon Hydraulic technologies.
External Measures:
ISO 26262-3:2017(E) – Clause 7.4.10 :
*** Please refer this clause from originally procured licensed copy of ISO26262 Part 3***
- External Measures is defined as measure that is separate and distinct from the item which reduces or mitigates the risks resulting from the item.
- For example, if the ABS system is the item under analysis, in case Electronic Stability Control (ESC) is also present in the vehicle, then it would act as an external measure. It also assists in better controllability of the vehicle.
- So, incase the external measures are also applicable then the FSRs related to it should also be derived.
- The FSRs related to the interfaces should also be derived.
- If the external measures are derived from one/more E/E systems, then FSRs shall be addressed using ISO 26262.
Sample Functional Safety Concepts for Antilock Braking System (ABS) Item
- As already explained in the FSC,
- Assignment of properties of each FSR.
- Identification of Systems or Sub Systems from Preliminary Architecture Diagram or Item Diagram.
- Allocation of FSRs to Systems/Sub Systems.
- The example for ABS Item is given below.
a) Assignment of FSR properties:
Notes:
#1 – Assuming the ABS
is activated 15 times per second to avoid any lock situation. Hence the full
cycle of Fault detection (Locking) and Fault Reaction (ABS activation) occurs
approximately (1000msec/15 = 66.6 msec). That can be divided as Fault detection
(Locking) – 30 msec and Fault Reaction (ABS activation) – 30 msec. So that (30
msec + 30 msec) < 66.6 msec.
#2 – These values may
vary based upon OEM requirements and on road analysis.
#3 – The BCM is
assumed to be main ECU which shall relay the failure status to Driver after
receiving from ABS. (ABS -> BCM -> Driver Dash board). The appropriate
choice of ECU shall be done by OEM.
#4
– It is assumed that the ABS failure LED on the dashboard shall be active
within 100msec of ABS module failure detection.
FSR ID
|
FSR Description
|
Safety Goal Allocation
|
ASIL Allocation
|
Operating Mode
|
Fault Tolerant Time Interval (FTTI)
|
Safe State
|
Type of Requirement
|
FSR_1
|
The ABS
module shall use the
- brake on/off activation signal
- wheel speed signal
for
engaging and disengaging the ABS functionality.
The ABS
should be activated only brake is pressed and if the speed is more than 15mph#2.
|
SG1,
SG2
|
D
|
ABS
Active,
ABS
Inactive (Normal Condition)
|
< 30
msec#1
|
ABS Disabled
|
Fault
Detection
|
FSR_2
|
The ABS
module shall receive the brake on/off activation signal.
|
SG1,
SG2
|
D
|
ABS
Active,
ABS
Inactive (Normal Condition)
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Detection
|
FSR_3
|
The ABS
module shall be able to detect the 4-wheel speed signal from the 4-wheel
speed sensors.
|
SG1,
SG2
|
D
|
ABS Active,
ABS
Inactive (Normal Condition)
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Detection
|
FSR_4
|
The ABS
module shall be able to detect the deceleration in any of the 4-wheels. It
shall also be able to detect any imminent wheel lock up scenario.
|
SG1,
SG2
|
D
|
ABS Active
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Detection
|
FSR_5
|
In case of
imminent wheel lock up scenario, then action shall be taken to prevent lock
up.
|
SG1,
SG2
|
D
|
ABS Active
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Reaction
|
FSR_6
|
The ABS
module shall have mechanism to detect if any error is present in brake
activation signal every time it is received.
|
SG3
|
D
|
ABS
Active,
ABS
Inactive (Normal Condition)
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Detection
|
FSR_7
|
The ABS
module shall have mechanism to detect if any error is present in 4-wheel speed
signal every time it is received.
|
SG3
|
D
|
ABS
Active,
ABS
Inactive (Normal Condition)
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Detection
|
FSR_8
|
The ABS
module shall execute the diagnostics test sequence after ignition and
determine any error present.
|
SG3
|
D
|
ABS Inactive
(Normal Condition)
|
< 30
msec#1
|
ABS
Disabled
|
Fault
Detection
|
FSR_9
|
In case of
any failure detected, the ABS module shall disengage the ABS and notify the
BCM#3.
|
SG3
|
D
|
ABS
Inactive (Normal Condition)
|
100 msec#4
|
ABS
Disabled
|
Fault
Reaction
|
FSR_10
|
In case of
any error detection arising of any of the failure, the ABS module shall shut
down and shall not affect normal braking of the vehicle.
|
SG3
|
D
|
ABS
Inactive (Normal Condition)
|
100 msec#4
|
ABS
Disabled
|
Fault
Reaction
|
b) Identification of Systems or Sub Systems from Preliminary Architecture Diagram or Item Diagram
- Considering the Item defined in the blog EmbeddedInEmbedded: ISO 26262 Part 3.5: Item Definition, the Item Diagram is further analysed to derive the System/ Sub Systems from this.
- The System/ Sub Systems may or may not be Safety related (ASIL - A/B/C/D) or Non Safety Related (ASIL - QM).
- It is generally better to have the Non Safety blocks in the ISO 26262 work products. This can be justified from following points:
- Separate documentations need not have to be maintained for them. Based upon the QM requirements you may choose to skip the compliance at different stages of analysis of Non Safety units.
- During the course of analysis, need may arise some non safety units getting converted into safety units and vice versa. By maintaining a common document, you can maintain the change history of such units.
- The list of Sub Systems derived for the Antilock Brake System (ABS) Item are described below.
Sub System
ID
|
Sub System
Name
|
ASIL Level
*
|
SS1
|
ABS Control Unit
|
D
|
SS2
|
Wheel Speed Sensing Unit
|
D
|
SS3
|
Brake Pedal Activation Sensing
Unit
|
D
|
SS4
|
Inlet Pressure Sensing Unit
|
D
|
SS5
|
Outlet Pressure Sensing Unit
|
D
|
SS6
|
Accumulator Pressure Sensing
Unit
|
D
|
SS7
|
ABS Warning Light Unit
|
D
|
SS8
|
Pump Motor Control Unit
|
D
|
SS9
|
Valve Control Unit
|
D
|
SS10
|
VEH CAN Module
|
D
|
SS11
|
Monitoring/Watchdog IC
|
D
|
NSS1
|
Diagnostics Module
|
QM
|
- The interaction between the different Sub Systems in the ABS Item is shown as a SysML diagram.
- The software used for preparation "StarUML", which is a free tool available for no for evaluation purpose. Please refer following link for details. StarUML
- The signals/interfaces between each Sub Systems are shown at a high level. The type or number of interfaces will change during various stages of ISO 26262 life cycle.
c) Allocation of FSRs to System/Sub Systems:
- Each of the FSR is then assigned to Sub Systems. By this it is checked whether every FSR has a corresponding unit for implementation and every unit of implementation is has a necessary FSR.
- Continuing with the ABS Item, all the FSRs are tagged to respective Sub Systems.
- The ASIL levels of the Sub Systems are derived from the assigned FSRs.
|
SR ID
|
FSR Description
|
Safety Goal Allocation
|
ASIL Allocation
|
Allocated to Sub System
|
|
FSR_1
|
The ABS
module shall use the
- brake on/off activation signal
- wheel speed signal
for
engaging and disengaging the ABS functionality.
The ABS
should be activated only brake is pressed and if the speed is more than 15mph#2.
|
SG1,
SG2
|
D
|
SS1, SS2,
SS3, SS11
|
|
FSR_2
|
The ABS
module shall receive the brake on/off activation signal.
|
SG1,
SG2
|
D
|
SS1, SS3,
SS11
|
|
FSR_3
|
The ABS
module shall be able to detect the 4-wheel speed signal from the 4-wheel
speed sensors.
|
SG1,
SG2
|
D
|
SS1, SS2,
SS11
|
|
FSR_4
|
The ABS
module shall be able to detect the deceleration in any of the 4-wheels. It
shall also be able to detect any imminent wheel lock up scenario.
|
SG1,
SG2
|
D
|
SS1, SS11,
SS2, SS3, SS4, SS5, SS6,
|
|
FSR_5
|
In case of
imminent wheel lock up scenario, then action shall be taken to prevent lock
up.
|
SG1,
SG2
|
D
|
SS1, SS11,
SS4, SS5, SS6, SS8, SS9
|
|
FSR_6
|
The ABS
module shall have mechanism to detect if any error is present in brake
activation signal every time it is received.
|
SG3
|
D
|
SS1, SS11,
SS3
|
|
FSR_7
|
The ABS
module shall have mechanism to detect if any error is present in 4-wheel
speed signal every time it is received.
|
SG3
|
D
|
SS1, SS11,
SS2, SS4, SS5, SS6, SS8, SS9, SS10
|
|
FSR_8
|
The ABS
module shall execute the diagnostics test sequence after ignition and determine
any error present.
|
SG3
|
D
|
SS1, SS2,
SS3,
|
|
FSR_9
|
In case of
any failure detected, the ABS module shall disengage the ABS and notify the
BCM#3.
|
SG3
|
D
|
SS1, SS11,
SS10, SS7
|
|
FSR_10
|
In case of
any error detection arising of any of the failure, the ABS module shall shut
down and shall not affect normal braking of the vehicle.
|
SG3
|
D
|
SS1, SS11
|
(...Continued in Next Part)
