Automotive Safety Integrity Level Research Articles

Energy-Efficient Functional Safety Design Methodology Using ASIL Decomposition for Automotive Cyber-Physical Systems

Automotive cyber-physical systems (ACPS) are typical cyber-physical systems because of the joint interaction between the cyber part and physical part. Functional safety requirement (including response time and reliability requirements) for an ACPS function must be assured for safe driving. Auto industry is cost-sensitive, power-sensitive, and environment-friendly. Energy consumption affects the development efficiency of the ACPS and the living environment of people. This paper solves the problem of optimizing the energy consumption for an ACPS function while assuring its functional safety requirement (i.e., energy-efficient functional safety for ACPS). However, implementing minimum response time, maximum reliability, and minimum energy consumption is a conflicting problem. Consequently, solving the problem is a challenge. In this paper, we propose a three-stage design process toward energy-efficient functional safety for ACPS. The topic problem is divided into three sub-problems, namely, response time requirement verification (first stage), functional safety requirement verification (second stage), and functional safety-critical energy consumption optimization (third stage). The proposed energy-efficient functional safety design methodology is implemented by using automotive safety integrity level decomposition, which is defined in the ACPS functional safety standard ISO 26262. Experiments with real-life and synthetic ACPS functions reveal the advantages of the proposed design methodology toward energy-efficient functional safety for ACPS compared with state-of-the-art algorithms.

Assessment of the functional safety of the lane departure warning system

This paper describes the advantages of using functional safety analysis according to the ISO 26262 standard. And also the necessary analyses (HAZOP, HAZOP, FMEA, FTA) for the LDWS system were performed and the rating has been determined automotive safety integrity level ASIL. As a result of the analysis of the developed lane departure warning system, 36 technical safety requirements were formulated. Assigned 8 security mechanisms, which are implemented by the software. Tests of the lane departure warning system for the effectiveness of the proposed requirements showed more stable operation of the system integrated into the transport vehicle. Keywords: functional safety, ASIL, ISO 26262, LDWS

A 12-nm Autonomous Driving Processor With 60.4 TOPS, 13.8 TOPS/W CNN Executed by Task-Separated ASIL D Control

This article proposes an automotive safety integrity level (ASIL) D, which is the highest automotive integrity level specified in ISO 26262, and a target application processor for driving automation systems with a high convolutional neural network (CNN) processing performance of 60.4 trillion operations per second (TOPS) with high power efficiency of 13.8 TOPS/W. To achieve both performance and power efficiency, a stream processing architecture specialized for CNN hardware module is adopted to implement many low-power arithmetic units. In addition, 6 MB of local memories are implemented to reduce data transfers between dynamic random access memory (DRAM) and the CNN hardware, thereby improving the execution efficiency of the arithmetic units and saving power consumption caused by the data transfer. In order to support high safety integrity level with power efficiency, we provide safety mechanisms with high failure detection rates only for the hardware used in applications that require ASIL D support. The configuration of two CNN modules can switch between lockstep and single operation depending on the use case, thus achieving a tradeoff between performance and ASIL while maintaining power efficiency. In addition, the freedom from interference (FFI) concept defined in ISO 26262 is achieved by providing mechanisms to prevent low safety level tasks from interfering with high safety level tasks running concurrently inside the processor.

Emergency Operation in the Power Supply Domain According to ISO 26262

The automotive industry is currently driven by the megatrends electrification, automated driving, and connectivity. To cope with these trends, new functionalities and electric and/or electronic systems must be developed, which require a safe power supply by the power supply system. This leads to increased functional safety requirements for the power supply system, particularly regarding availability. Fault tolerance measures can be implemented to address a safety goal specifying a safety-related availability requirement. In this case, emergency operation (EO) may be necessary to reach a defined safe state. The definitions and examples provided in ISO 26262 focus on cold redundancy, whereby the backup system is not engaged during nominal operation. The objective of this paper is to evaluate EO in the context of ISO 26262 in detail and map the results to an exemplary power supply system architecture implementing cold redundancy. In general, the EO is considered to be free from unreasonable risk even though the actual automotive safety integrity level (ASIL) capability of the item is lower than the initially specified ASIL rating for the hazard due to its timing restrictions. To determine the maximum permissible duration of EO, not just random hardware faults shall be considered; additionally, systematic effects shall be considered. Furthermore, an EO may be entered due to transient faults potentially causing temporary EOs – introducing the necessity of an EO recording, e.g. by accumulating the time of all temporary EOs.

Development and Experimental Validation of High Performance Embedded Intelligence and Fail-Operational Urban Surround Perception Solutions of the PRYSTINE Project

Automated Driving Systems (ADSs) commend a substantial reduction of human-caused road accidents while simultaneously lowering emissions, mitigating congestion, decreasing energy consumption and increasing overall productivity. However, achieving higher SAE levels of driving automation and complying with ISO26262 C and D Automotive Safety Integrity Levels (ASILs) is a multi-disciplinary challenge that requires insights into safety-critical architectures, multi-modal perception and real-time control. This paper presents an assorted effort carried out in the European H2020 ECSEL project—PRYSTINE. In this paper, we (1) investigate Simplex, 1oo2d and hybrid fail-operational computing architectures, (2) devise a multi-modal perception system with fail-safety mechanisms, (3) present a passenger vehicle-based demonstrator for low-speed autonomy and (4) suggest a trust-based fusion approach validated on a heavy-duty truck.

Functional Safety BMS Design Methodology for Automotive Lithium-Based Batteries

The increasing use of lithium batteries and the necessary integration of battery management systems (BMS) has led international standards to demand functional safety in electromobility applications, with a special focus on electric vehicles. This work covers the complete design of an enhanced automotive BMS with functional safety from the concept phase to verification activities. Firstly, a detailed analysis of the intrinsic hazards of lithium-based batteries is performed. Secondly, a hazard and risk assessment of an automotive lithium-based battery is carried out to address the specific risks deriving from the automotive application and the safety goals to be fulfilled to keep it under control. Safety goals lead to the technical safety requirements for the next hardware design and prototyping of a BMS Slave. Finally, the failure rate of the BMS Slave is assessed to verify the compliance of the developed enhanced BMS Slave with the functional safety Automotive Safety Integrity Level (ASIL) C. This paper contributes the design methodology of a BMS complying with ISO 26262 functional safety standard requirements for automotive lithium-based batteries.

Risk Assessment and Development Cost Optimization in Software Defined Vehicles

Vehicle design has entered a new stage, namely, Software Defined Vehicles (SDV), where functional safety is required to be guaranteed for risk control, and development cost needs to be optimized for profit maximization. This paper targets to optimize the development cost under the functional safety requirement for a safety-aware SDV, based on the automotive safety integrity level (ASIL) decomposition defined in ISO 26262. For this, a two-stage solution is proposed, which includes functional safety risk assessment and development cost optimization. The first stage develops a new fast risk assessment (FRA) algorithm to assess the functional safety risk, including the joint reliability risk and the real-time risk, of the SDV functionality. The second stage proposes a dual requirement guarantee (DRG) algorithm to optimize the development cost considering reliability and real-time requirements jointly. Our experiments demonstrate that the proposed two-stage solution guarantees the functional safety requirement while reducing the development cost by 20%-24%.

Online Safety Checking for Delay Locked Loops via Embedded Phase Error Monitor

In today's automotive ICs, online safety checking is often required in order to achieve a high Automotive Safety Integrity Level (ASIL). For a Delay-Locked Loop (DLL), the most important safety (or health) indicator is the “phase error between the input clock signal and the output clock signal”. In this paper, we present a phase error monitoring scheme for DLLs, using circuits made of only standard cells. The proposed scheme can monitor the phase error continuously to record its worst-case values during a designated monitoring session. As a result, hazardous phase error glitches can be exposed and an alarm can be raised. We have implemented this monitoring scheme for a Delay Lock Loop in a 90 nm CMOS process and post-layout simulation is conducted to verify its effectiveness. Experimental results show that it can help expose hazards induced by dynamic power glitches that occurs within 1ns.

Functional safety and reliability for innovative vehicle braking system and integration with electric traction units

Newly electric vehicle architectures require intensive virtual and physical testing for safety assessment, due to the increasing relevance of By-Wire systems and the presence of innovative control algorithms for ordinary driving scenario, potential emergency situations or Advanced Driver-Assistance Systems implementation purpose. To reduce the development time while increasing system reliability and the a priori knowledge about its safety requirements, the evaluation of such aspects should be performed. In accordance to ISO26262 standard, authors propose a systematic approach based on Virtual FMEA, in order to assess the functional safety level of hybrid brake plant. Plant modification and securing strategy as been presented and implemented in target vehicle model, evaluating their performances in simulation environments, in order to met required Automotive Safety Integrity Level. This work is developed in the ambit of OBELICS European Project.

Tracking Automotive Electronics Related Sensory and Their Traceability by Boundary Scan Technology

This paper proposes several Python-based test methods to study a series of MCU-associated sensors. In light of today's automotive electronics, many electric systems are involved in modularized bare dies such as power management ICs along with embedded programming. As to the application of autonomous driving like the ADAS system, having many Multiple-Chips Modules (MCM) which are popular in SoC related functional boards. It is necessary to have these electrical systems follow stringent safety standards and regulations by the International Electrotechnical Commission (IEC). That is to ensure the electronic systems to be designed, implemented, operated within safety range. That is traceable according to the prerequisite Safety Integrity Level (SIL) besides the Automotive Safety Integrity Level (ASIL) towards five classes. These classes further evolved into higher requirements such as IEC-61508 and more recently the ISO-26262. All of these, have driven many companies to research and develop a suite of methods and strategies to solve some of the “reliability” associated issues, especially in the area of autonomous driving. This paper proposes the boundary scan based test methodology to cop with government’s regulations by tracking some of the major sensors in responses to motion, temperature and dynamic forces based on a JTAG’s sensor board in case study A. Thereafter, using an NXP’s automotive board to trace on board electronics, mainly the CPU and MCU via the MODBUS is made possible to log and record test results through VB.XML.NET. These languages speak uniformly to the relational data base in one “DataSet” by in-memory cache of the data retrieved from a database, in case study B. Both are realized by the JTAG’s Functional Test (JFT) system, to log the “pass or fail” results in a sequential execution. This paper illustrates how-to reach this goal through the process in use of the public-domain based open frame-ware, and to demonstrate them on a JTAG’s Provision platform throughout the development stages.

Automotive Architecture Topologies: Analysis for Safety-Critical Autonomous Vehicle Applications

Safety-critical systems such as Advanced Driving Assistance Systems and Autonomous Vehicles require redundancy to satisfy their safety requirements and to be classified as fail-operational. Introducing redundancy in a system with high data rates and processing requirements also has a great impact on architectural design decisions. The current self-driving vehicle prototypes do not use a standardized system architecture but base their design on existing vehicles and the available components. In this work, we provide a novel analysis framework that allows us to qualitatively and quantitatively evaluate an in-vehicle architecture topology and compare it with others. With this framework, we evaluate different variants of two common topologies: domain and zone-based architectures. Each topology is evaluated in terms of total cost, failure probability, total communication cable length, communication load distribution, and functional load distribution. We introduce redundancy in selected parts of the systems using our automated process provided in the framework, in a safety-oriented design process that enables the ISO26262 Automotive Safety Integrity Level decomposition technique. After every design step, the architecture is re-evaluated. The advantages and disadvantages of the different architecture variants are evaluated to guide the designer towards the choice of correct architecture, with a focus on the introduction of redundancy.

New safe reliable design methodologies examined by fault injection testing and Monte Carlo simulation: tolerating shared-memory interferences in multicore architectures

Nowadays, the automotive industry utilises multicore processors to meet autonomous driving requirements. This imposes a higher complexity on the development and the verification of software applications. Compliance to the ISO 26262 safety standard increases this complexity. In this paper, means of shared-memory interferences that affect Automotive Safety Integrity Level (ASIL)-D multicore architectures have been addressed. This work proposes new safety mechanisms to detect and react to systematic and random transient memory faults as follows: 1) an enhanced software partitioning design pattern; 2) a new methodology on the memory protection unit; 3) an improved stack monitoring mechanism. New safe and reliable design configurations are introduced. The proposed safety mechanisms have been evaluated for Aurix multicore targets with suggestions to have a fully compliant architecture followed with ISO 26262 methods and principles of tolerating memory interferences. A novel fault injection platform is presented to show the experimental results with a Monte Carlo simulation proof of concept.

Driver Model Based on Optimized Calculation and Functional Safety Simulation

The simulation of electronic control function failure has been utilized broadly as an evaluation method when determining the Automotive Safety Integrity Level (ASIL). The driver model is quite critical in the ASIL evaluation simulation. A new driver model that can consider drivers of different driving skills is proposed in this paper. It can simulate the overall performance of different drivers driving vehicles by adjusting parameters, with which the impact of a certain electronic control function failure and the ASIL are evaluated. This paper has taken the function failure of regenerative braking as the simulation object in the double-lane-change driving scenario to simulate typical driving conditions with the designed driver model, and then has obtained the ASIL of regenerative braking function, which is applied to a BAIC new energy vehicle development project.

Safety-Guaranteed and Development Cost- Minimized Scheduling of DAG Functionality in an Automotive System

It is important to sufficiently guarantee an automotive system’s safety, because otherwise terrible consequences may happen. Generally the safety in an automotive system includes two aspects: reliability and timeliness. Previous studies have proposed many approaches to how to improve them. However, few of them consider the development cost along with their improvement. In this study, we aim to propose a method that can build a safety-guaranteed and development cost-minimized schedule for functionality modeled as a directed acyclic graph running on an automotive system. Unlike previous studies that tightly couple the development cost minimization with other requirements together, we start by building a schedule with the minimum development cost by ignoring safety requirement. Then, reliability and real-time requirements are subsequently taken into consideration. Together with automotive safety integrity level decomposition options provided by International Standard called ISO 26262, the decomposition is evaluated for each task to improve its safety, and tasks are then successively chosen to adjust the schedule, such that its safety can be maximized with incurring the least extra development cost. This procedure continues until a schedule that meets safety requirement is built. Experiments on a real-life automotive benchmark and extensive synthetic functionality demonstrate that our proposed heuristics outperform the state-of-the-art heuristic algorithm, and a typical intelligent optimization algorithm.

A Novel Hazard Analysis and Risk Assessment Approach for Road Vehicle Functional Safety through Integrating STPA with FMEA

ISO26262: 2018 is an international functional safety standard for electrical and/or electronic (E/E) systems within road vehicles. It provides appropriate safety requirements for road vehicles to avoid unreasonable residual risk according to automotive safety integrity levels (ASILs) derived from hazard analysis and risk assessment (HARA) required in the ISO26262 concept phase. Systems theoretic process analysis (STPA) seems to be designed specifically to deal with hazard analysis of modern complex systems, but it does not include risk evaluation required by most safety related international standards. So we integrated STPA into Failure Mode and Effect Analysis (FMEA) template to form a new method called system theoretic process analysis based on an FMEA template, STPAFT for shot, which could not only meet all the requirements of the concept phase in ISO26262, but also make full use of the advantages of the two methods. Through the focus of FMEA on low-level components, STPAFT can obtain more detailed causal factors (CFs), which is very helpful for derivation of safety goals (SGs) and the functional safety requirements (FSRs) in the concept phase of ISO26262. The application of STPAFT is described by the case study of fuel level estimation and display system (FLEDS) to show how the concept phase of ISO26262 could be supported by STPAFT.

Adaptive modeling in the frequency and time domain of high-power lithium titanate oxide cells in battery management systems

Lithium-ion batteries play a major role for the reliability and safety of the energy supply in vehicle power networks. Battery management systems (BMS) are needed to monitor the battery's inner states, such as state of charge or state of available power. State-of-the-art algorithms running on a BMS cannot fulfill all today's requirements completely such as qualification for an automotive safety integrity level, implementation on low-cost hardware, adaption to different kinds of aging effects and minimized excitation in a vehicle's power network. In this paper a new approach for online parameter estimation of a battery model for a lithium-ion battery with titanate oxide anode is presented. The approach combines simple mathematical equations and low memory consumption while still adapting dynamically to different aging effects. In order to handle different types of excitation in the power network, three methods are suggested for analyzing the battery behavior in the time and frequency domain. The algorithms are validated utilizing real driving profiles applied to aged batteries. Therefore, calendric and cyclic battery aging tests were carried out for about two years and up to 100,000 equivalent full cycles. The frequency-based methods are advantageous in terms of impedance parameter tracking while the methods using time-domain parameterization data benefit in terms of time predictions. All proposed methods show promising results regarding voltage predictions independent of the battery's state of health.

Quantitative ASIL Estimation Using Fuzzy Set Theory

The present study proposes a method that numerically quantifies automotive safety integrity level (ASIL). Additionally, the method reduces the uncertainty in the risk estimation step by subdividing the ASIL step by applying fuzzy theory to reduce the ambiguity of ASIL with an extremely wide step. The conventional risk-based design concept is adopted to quantify ASIL, and fuzzy modeling is used to express the vehicle safety integrity ratings of uncertain automotive electrical equipment. To overcome the uncertainty, we fuzzify the variable using the mean expected value method and select the trapezoidal fuzzy number. The final fuzzy output is generated using Mamdani’s method with 25 fuzzy rules combined with variables to obtain risk. This theory provides a useful approach for overcoming the inherent uncertainty in ASIL. We attempt to establish the effectiveness of the proposed method by utilizing it to quantify the automatic emergency-braking device scenario, which is a typical target system.

Power Supply Platform and Functional Safety Concept Proposals for a Powertrain Transmission Electronic Control Unit

In the last decade, modern vehicles have become very complex, being equipped with embedded electronic systems which include more than a thousand of electronic control units (ECUs). Therefore, it is mandatory to analyze the potential risk of automotive systems failure because it could have a significant impact on humans’ safety. This paper proposes a novel, functional safety concept at the power management level of a system basis chip (SBC), from the development phase to system design. In the presented case, the safety-critical application is represented by a powertrain transmission electronic control unit. A step-by-step design guideline procedure is presented, having as a focus the cost, safety, and performance to obtain a robust, cost-efficient, safe, and reliable design. To prove compliance with the ISO 26262 standard, quantitative worst-case evaluations of the hardware have been done. The assessment results qualify the proposed design with automotive safety integrity levels (ASIL, up to ASIL-D). The main contribution of this paper is to demonstrate how to apply the functional safety concept to a real, safety-critical system by following the proposed design methodology.

New Aspects of Integrity Levels in Automotive Industry-Cybersecurity of Automated Vehicles

The spread of connected vehicles is expected to multiply the effects of the growing penetration of cyberspace in our life, and with this it remarkably influences the vulnerability of society to cyberattacks in an unfavorable way. Accordingly, ZalalZone - the Hungarian test track – has set up a working group to support the necessary methodological background for cybersecurity-related validation processes for the automotive industry. Therefore the paper aims to reconsider safety integrity levels in the automotive industry related to the field of cybersecurity. Following this, the article provides a comprehensive structure of integrity levels that serves the safety requirements of nowadays new cybersecurity challenges. To adapt the new cybersecurity integrity level architecture to the conventional automotive safety integrity level framework, the authors have verified a specific clustering model. To validate the aggregated probability of the possible cyberattack alternatives, the generated new cybersecurity rating scale is compared with the ASIL probability values by applying the Kolmogorov-Smirnov test. In the final step of the analysis, the possible practical application of the new framework is presented based on the identification of the derived probability value in the case of the investigated failure mode.

Advanced methods for safe visualization on automotive displays

AbstractCamera Monitor Systems (CMSs), for example, for backup cameras or mirror replacements, become increasingly important and already cover safety aspects such as guaranteed latency and no frame freeze. Today's approaches deal only with supervision of the digital interface, LCD backlight, and power supply. This paper introduces methods for advanced safety monitoring of panel electronics and optical display output that aim to enable future CMS based automotive use cases. Our methods are based on correlation of physical measurements with predicted values derived from a corresponding display model. This model was made via calibration measurements and many test patterns. Correlation of the monitoring results with predicted values corresponds to the probability that the RGB data are shown as intended. This implies that an overlying system, an Automotive Safety Integrity Level (ASIL) Prepared Video Safety System (APVSS), ensures that only safety verified RGB data are provided to the panel electronics. In case of failures, our methods enable a safe system state, for example, by deactivating the panel. An additional challenge is to allow graceful degradations, a safe but slightly degraded image may provide a better customer experience compared with no information. We successfully verified our approach by a fully functional prototype and extensive evaluation towards “light‐to‐light” (camera to display output) supervision.