ISO26262 Reflection and Deviations (Open Question List)
Duong TRAN ????
Technical (Project/Department) Manager | Senior Team Leader | Senior R&D Engineer | +20 Years Experience
Hello there! While studying and trying to follow ISO26262 guidelines, I felt overwhelmed by many very general guidelines in ISO26262 => how many people do agree with me? (^_^)
In this article, I only want to present some my reflections on and deviations from ISO26262 in Functional Safety Concept by raising a list of open questions for discussion purpose.
1. Level of Detail of the preliminary architecture
2. Safety Analysis
When specifying the functional safety requirements, ISO-26262 states that one can use safety analysis techniques such as FMEA, FTA or HAZOP in order to develop a complete set of functional safety requirements. What if we have no experience with the above mentioned analyses or only know one (for example: FTA), and at the same time feel confident that we could produce a complete set of FSRs without it, how can we derive FSRs from safety goals?
3. Fault Tolerant Time Interval (FTTI) determination
Another remark is the fault tolerant time interval for each functional safety requirement and safety goal. In ISO26262, Part 4, 6.4.2.3, it states "In-vehicle testing and experimentation can be used to determine the fault tolerant time interval." As there is no guidance to how to determine fault tolerant time interval in part 3 of ISO-26262, we are assuming the same means could be used in Part 3. However, as we lack the means of doing these tests, how to estimate the FTTI stated for each FSR in this work product?
4. Emergency Operation
The ISO-26262 standard, [6, Part3, 8.4.2.4], states that "If a safe state cannot be reached by a transition within an acceptable time interval, an emergency operation shall be specified." Some open questions came to my mind as follows:
We have not found an answer to the last question in the ISO-26262 standard, nor anywhere else. Due to all these unanswered questions, should we choose not to specify any emergency operations, since it would be based on guesses?
5. ASIL Decomposition
When performing ASIL decomposition, ISO-26262 states that the elements used for decomposition need to be independently implemented. But to what extent?
For example, if you implement two redundant elements on two different ECUs, does these ECUs have to be bought from two different manufacturers? And if they are, what if these ECU manufacturers buy their components from the same supplier? And so on.
The reason I am asking this question is that in the future, when and if ISO-26262 becomes required by law, vehicle manufacturers will want to put redundant elements on the same ECU for different reasons such as cost and area consumption. This ECU would obviously need separate CPUs, memories etc. But will it also need separate power supplies? Does the CPUs need to be of different brands and type? Questions like these need to be clearly answered in ISO-26262.
PS: Hopefully after reading this article, you who are FUSA experts can give me some your own ideas or share your experience to be clear many vague guidelines in ISO26262.
Thank you, and see you in my next articles (^_^)
Lead Engineer - Functional Safety at Ford Motor Company
5 个月"Yes"
functional safety expert at TUEV automotive Austria
5 个月Hi Duaong! you need the process oriented project work. what does it mean? ISO 26262-2011/2018 is very easy to understand (like a bible). About 107-117 work products (WP) should be created for the ISO 26262 compliant development of the ECU. A WP is only completed in accordance with the standard if it has been created and reviewed by independent qualified experts and the review- report shows that the WP is correct and complete. The evidence of all completed work packages is compiled in the safety case. The safety case is the first document that an assessor likes to check. It is very difficult to create these work products without many years of experience. To make the WPs manageable, some WPs can be combined into a single WPS, e.g. allocation/mapping of 117 WPs to e.g. 21-25. ?continued-....
functional safety expert at TUEV automotive Austria
5 个月Continued Next steps -Specification of the company's functional safety work products (naming of the mentioned 21-25 work products) -Create functional safety gates/milestones with the project manager -Creation of a compliance matrix: mapping scheme of 117 work products to e.g. 21-25 work products -Creation of a template for each allocated WPs, i.e. all disciplines can create the WPs without considering details in ISO 26262 -Creation of a checklist for the technical and confirmatory review -Review of the WPs -Creation of safety case -Support with assessment and audit This is referred to as process-oriented project work.
Optimise Functional Safety in SW and System development organisation
5 个月It is important to understand that ISO 26262 and other standard define the state of technology at a point of time in the past. This is why it never gives concise approaches and checklists. For every product You sell, You have to provide an argumentation, why You dare to sell it, why it's state of technology, to avoid product liability. This is then the safety case. Read the preamble of each Iso band. If you see it like this, create concepts,analysis approaches and get some experts agree with them. This is what a supplier has to do with each OEM individually. I could give You some advice on this, but I would need more details to give You a competent answer...