Functional Safety Standards Research Articles

Electro-Mechanical Brake System Architectural Design and Analysis Based on Functional Safety of Vehicles

Electro-mechanical brake (EMB) systems have garnered significant attention due to their distributed architecture. However, their signals from the brake pedal to the wheel-end actuators (WEAs) are transmitted electrically, meaning that any fault in EMB systems can severely impair the braking performance of vehicles. Consequently, the functional safety issues of EMB systems are the primary limitation of their widespread adoption. In response, this study first introduced the typical architectures of EMB and evaluated the automotive safety integrity level (ASIL) that must be achieved. Based on this, an EMB system architecture that satisfies functional safety standards was proposed. To accurately analyze the main factors affecting the probabilistic metric for hardware failures (PMHF) of the architecture, the failure rate of WEAs is further discussed. Specifically, a Markov chain was employed to define the operating states of the WEA matrix. The availability of each operating state was assessed based on the fault-tolerant control strategy. Finally, the failure rates of critical EMB parts, particularly the WEA matrix, were calculated. The results indicate that the unavailability of the WEA matrix is 9.244 × 10−3 FIT. Furthermore, the PMHFs of the EMB system for each safety goal are 6.14 FIT, 5.89 FIT, and 6.03 FIT, respectively, satisfying the ASIL-D requirements.

A Holistic Approach to Cybersecurity Integration in Autonomous Vehicles

The breakthrough of the self-driving car technology is a double-edged sword that gives us incredible opportunities and at the same time, it is the source of huge cybersecurity challenges. This paper champions the creation of a complete legal system and worldwide standards, like the ISO 26262, to regulate different parts of the autonomous vehicle (AV) operations, such as safety testing, liability, data privacy, and cybersecurity. By highlighting the significance of cybersecurity from the very start, the stakeholders and the automakers have to incorporate the practices like secure programming, routine updates, intrusion detection systems and encryption methods which will be the effective shield against the unauthorized access and data breaches. People should be informed and educated about the cybersecurity risks of AVs so that they can take the steps to protect themselves. Nevertheless, the integration of AVs with the Internet of Things (IoT) and other devices makes the cybersecurity landscape even more complicated, which means that there is a constant need for research and development to deal with problems like adversarial attacks. Presently, the deep learning-driven AV systems do not have the explainability which complicates the safety-critical applications, hence the need to increase the resilience training and deepen the deep learning models against attacks. The paper goes through all the literature on AV cybersecurity which stresses the need for functional safety standards and cybersecurity engineering guidelines. Collaboration between the governments, the industry, and the researchers is a must to set the legal foundations and the technical details for the AV cybersecurity across all levels of automation. Finally, solid cybersecurity is the key to the success of the autonomous vehicle revolution, hence the road to transformative safety, efficiency, and sustainability is paved. INDEX TERMS: Autonomous vehicles, Cybersecurity, ISO 26262, Encryption methods, ISO 21434, EU regulations, Security and Privacy.

Mapping to IEC 61508 the hardware safety integrity of elements developed to ISO 26262

Over the years, several functional safety standards for industries that handle safety electrical, electronic and electromechanical systems have been developed from IEC 61508 (generic). These include ISO 26262 (automotive), IEC 61511 (process), EN 50129 (railway), IEC 620621 (machinery), IEC 61513 (nuclear), etc. The emergence of these standards gives to the associated industries domain-specific identities. However, in certain cases, the rate of updating the standards is greatly overtaken by the rapid evolution of new technologies with a high potential to obsolete existing designs. Besides, IEC 61508-based critical components may experience shortage in the event of a global disaster as seen during the Covid-19 pandemic, hence the need for a robust substitution means. To address these problems, the concept of cross-domain reuse of resources is being promoted between industries that have unequal pace of alignment to the state-of-the-art. However, the framework for domain-to-domain (D2D) exchange must be clearly defined to avoid confusion. The objective of this paper is to investigate whether and how safety levels defined in ISO 26262 (automotive) can be mapped to safety levels in IEC 61508. The paper builds on review of literature and standards and is delimited to hardware elements.

AC Power Cycling Test Setup and Condition Monitoring Tools for SiC-Based Traction Inverters

AC power cycling tests allow the most realistic reliability assessment by applying close to real stress to the device or module under test to meet functional safety standards, which is highly critical for traction applications. This paper presents a comprehensive guideline and shares critical know-how to develop a 120 KVA AC power cycling test setup for high-power Silicon Carbide (SiC) modules. As of today, traction applications can not generate an early warning signal for drivers to replace critical components on time. For this purpose, the suitable precursors for all dominant failure mechanisms are discussed, and the corresponding condition monitoring tools are proposed to monitor the device aging on power converters. These condition monitoring tools are integrated into the built-in desaturation protection circuit of the electric vehicle (EV) gate driver for low-cost, practical implementation. The on-resistance of all twelve switches is monitored online as a temperature-sensitive electrical parameter (TSEP) to measure the junction temperature of the devices. To avoid heavy processing load in the microcontroller, the out-of-order equivalent time sampling technique is developed for data sampling, which leads to a measurement error of less than 1.5%. In addition, the design considerations regarding common mode noise and aging effect on DESAT protection are investigated, and experimental findings are presented.

STLs for GPUs: Using High-Level Language Approaches

Self-Test Libraries (STLs) are widely used for in-field fault detection in processor-based systems. Currently, their adoption is being extended to Graphics Processing Units (GPUs), due to their increasing usage in the safety-critical domain, and the demand for effective in-field functional safety mechanisms mandated by the functional safety standards (e.g., ISO 26262 for automotive). This work describes a method to develop suitable STLs resorting to High-Level Languages (HLLs) (e.g., CUDA) for some modules in GPUs, thus reducing the complexity of the STLs development process. We also discuss the method’s main advantages/limitations, as well as the challenges and constraints when developing HLL STLs for GPUs. Furthermore, we outline those cases demanding the usage of Low-Level Languages (LLLs) for the implementation of STLs. The evaluation and validation of the method resort to the FlexGripPlus GPU model, implementing one micro-architecture of NVIDIA. The experimental results show that HLL STLs can be effectively developed for regular modules in the GPU.

Brake-by-wire architecture design and analysis in accordance with functional safety standard

The brake-by-wire (BBW) system is one of the safety-critical components of intelligent vehicle chassis, and ensuring its reliability requires a comprehensive functional safety design process. Although many studies have been conducted on electro-mechanical braking (EMB), there is a lack of relevant content on electro-hydraulic braking (EHB), another scheme of BBW system. And the key components affecting EHB system reliability need to be further explored. To address these issues, a system-architecture for EHB with fail-operational capabilities based on ISO 26262 is proposed. Additionally, Fault tree analysis (FTA) and Bayesian network (BN) are used for assessing its reliability. Fault tree (FT) is established to quantitatively calculate the Automotive Safety Integration Level (ASIL). Then FT is mapped into BN, and the conditional probability table is modified to express the polymorphic and uncertain logical relationship of events. To mitigate the dimensional disaster caused by numerous risk factors in the joint probability distribution, a Noisy-or gate method is applied in the BN to address this problem. Finally, the crucial events of system reliability are analyzed. The results indicate that the proposed EHB architecture can meet the safety and reliability requirements of ASIL D and can provide essential reference for the design of EHB related fail-operational system.

On Neural Networks Redundancy and Diversity for Their Use in Safety-Critical Systems

An increasing number of critical functionalities integrated in embedded critical systems rely on deep learning (DL) technology. This article summarizes certain key aspects of DL’s intrinsic stochastic and training-data-dependent nature that are at odds with current domain-specific functional safety standards. We exemplify how redundancy and diversity of neural networks can help to reconcile DL technology and functional safety requirements.

Analyzing execution path non-determinism of the Linux kernel in different scenarios

Safety-critical systems play a significant role in industrial domains, and their complexity is increasing with advanced technologies such as Artificial Intelligence (AI). To provide efficient services, safety-critical systems that integrate AI applications are always built based on Linux, where Linux offers massive amounts of features and an incredibly perfect software ecosystem for AI applications. Since Linux is a pre-existing complex software system, different research programmes aim to pave the way for developing Linux-based safety-critical systems. Still, only some focus on the system calls for file operations. However, the execution path of a system call is effectively non-deterministic in Linux kernel space, which challenges the test coverage-based verification recommended by the functional safety standards. This research analyzes the influence of system state on Linux kernel path variability from two perspectives: file system type and system load. Therefore, an online data collection system for system call execution paths was constructed based on Ftrace, network file system (NFS), and MD5 hash function, uniquely identifying the system call execution path. The collected data were processed and analysed in this study. Evaluations show that the number of function execution paths of the system calls relevant to file systems increased with the increase in system load but would eventually be stable. Additionally, the function execution paths of the system call varied in different file systems. Based on the evaluations, the results of this work can provide advice for analyzing Linux-based safety-critical systems. In addition, the method introduced in this research can also provide support for the verification of Linux-based safety-critical systems.

Functional Safety Standards Committee: Results and Perspectives

The Functional Safety Standards Committee (FSSC) turned one year old. This article describes the FSSC results both in terms of sponsorship of IEEE Computer Society safety-related standards (for example, IEEE P2851) and of nurturing new initiatives.

The Universal Safety Format in Action: Tool Integration and Practical Application

Designing software that meets the stringent requirements of functional safety standards imposes a significant development effort compared to conventional software. A key aspect is the integration of safety mechanisms into the functional design to ensure a safe state during operation even in the event of hardware errors. These safety mechanisms can be applied at different levels of abstraction during the development process and are usually implemented and integrated manually into the design. This does not only cause significant effort but does also reduce the overall maintainability of the software. To mitigate this, we present the Universal Safety Format (USF), which enables the generation of safety mechanisms based on the separation of concerns principle in a model-driven approach. Safety mechanisms are described as generic patterns using a transformation language independent from the functional design or any particular programming language. The USF was designed to be easily integrated into existing tools and workflows that can support different programming languages. Tools supporting the USF can utilize the patterns in a functional design to generate and integrate specific safety mechanisms for different languages using the transformation rules contained within the patterns. This enables not only the reuse of safety patterns in different designs, but also across different programming languages. The approach is demonstrated with an automotive use-case as well as different tools supporting the USF.

Inference algorithms for the useful life of safety instrumented systems under small failure sample data

Safety instrumented systems(SIS) have been widely used in petroleum and chemical plants to detect and respond to dangerous events and prevent them from developing into accidents. The in-service time of SIS does not exceed its useful life is one of the crucial assumptions of IEC functional safety standards. The testing method recommended in the IEC standard is essentially a chi-square testing, where the testing effect is proportional to the sample size and, therefore, not suitable for testing the type of data distribution under small samples. In this paper, a rapid inference method of useful life (RIUL) is proposed to: i) determine whether the distribution type of failure data is exponential under small samples with the help of Anderson-Darling testing, and ii) use the Bayesian sequential testing method for estimating the useful life. The sequential posterior odds ratio testing is introduced to test the equipment failure rate one by one. The proposed RIUL approach is applied to the liquid-level protection circuit of the hot high-pressure separator. The engineering simulation results show that compared with IEC standard methods, the proposed method can be performed with fewer failure data, providing a theoretical basis for reasonable maintenance and replacement of equipment.

Redefining rail systems verification and validation: The safety/security STAIRCASE model

Safety critical functions of the engineered railway need to perform at levels of integrity that are so high that an acceptable failure rate cannot be demonstrated through testing alone. Where such functions need to be implemented in complex programmable electronic systems certain design, build and test requirements are defined in technical standards and these are deemed to ensure that the correct level of systematic integrity is achieved. These approaches are based on assumptions around how system requirements are managed and delivered which are increasingly challenging to meet in practice. In particular the V&V lifecycle used in functional safety standards and emerging cyber security design standards is idealised. It assumes a top-down cascade of requirements for each delivery project. The approaches have become the de-facto standard internationally and are now mandated to an extent in European railway safety regulations. This paper proposes a different approach: a new lifecycle model that aligns better with the reality of the modern global supply chain and the order in which asset design and project delivery activities are actually undertaken to improve the ability to proactively manage safety.This leads to a fundamental change in the assurance philosophy to bring a simpler and more understandable approach. A framework for applying this approach is set out along with further research objectives to deliver the solution in practice.

Cross-acceptance of fire safety systems based on SIL equivalence in relation to IEC 61508 and EN 50129

Several sectors, e.g. process, railway, etc., have set their functional safety standards based on the generic IEC 61508. Yet, a product that is originally developed based on IEC 61508 is not automatically accepted for use in specific industries. Therefore, companies that are keen on selling safety products across sectors are faced with the challenge of satisfying the requirements sector by sector, thus incurring more cost and time to market. Cross-acceptance across industries is expected to solve this problem. However, an approach with a quantitative focus (e.g. in relation to SIL) has yet to be identified and validated. Demonstrating consistency and compatibility between cross-domain standards in relation to system safety is necessary for harmonising safety integrity claims. This paper applies the relationship between PFDavg and THR to cross-acceptance, establishing SIL equivalence as a basis for cross-acceptance, supporting this with data prioritisation and recommending it together with architectural constraints, systematic capability, the original safety case, a supplementary safety case (accounting for differences between the original and target standards provisions), and the original safety manuals (for COTS components and the whole system) as a framework for achieving both IEC 61508 (generic) and EN 50129 (railway) certification for a fire detection system.

A cyber–physical–social approach for engineering Functional Safety Requirements for automotive systems

Several approaches have been developed to assist automotive system manufacturers in designing safer vehicles by facilitating compliance with functional safety standards. However, most of these approaches either mainly focus on the technical aspects of automotive systems and ignore the social ones, or they provide inadequate analysis of such important aspects. To this end, we propose a model-based approach for modeling and analyzing the Functional Safety Requirements (FSR) for automotive systems, which considers both the technical and social aspects of such systems. This approach is based on both the ISO 26262 and ISO/PAS 21448 standards, and it proposes a detailed engineering methodology to assist designers while modeling and analyzing FSR. In particular, this approach proposes a UML profile for modeling the FSR of the automotive system starting from item definition until safety validation, and it offers constraints expressed in Object Constraint Language (OCL) to be used for the verification of FSR models. We demonstrated the applicability and usefulness of the approach relying on a realistic example from the automotive domain, and we also evaluated the usability and utility of the approach with potential end-users.

A Novel ISO 26262-Compliant Test Bench to Assess the Diagnostic Coverage of Software Hardening Techniques against Digital Components Random Hardware Failures

This paper describes a novel approach to assess detection mechanisms and their diagnostic coverage, implemented using embedded software, designed to identify random hardware failures affecting digital components. In the literature, many proposals adopting fault injection methods are available, with most of them focusing on transient faults and not considering the functional safety standards requirements. This kind of proposal can benefit developers involved in the automotive market, where strict safety and cost requirements make the adoption of software-only strategies convenient. Hence, we have focused our efforts on compliance with the ISO 26262 automotive functional safety standard. The approach concerns permanent faults affecting microcontrollers and it provides a mapping between the failure mode described in part 11 of the Standard and the chosen fault models. We propose a test bench designed to inject permanent failures into an emulated microcontroller and determine which of them are detected by the embedded software. The main contribution of this paper is a novel fault injection manager integrated with the open-source software GCC, GDB, and QEMU. This test bench manages all the assessment phases, from fault generation to fault injection and the ISA emulation management, up to the classification of the simulation results.

Towards functional safety compliance of matrix–matrix multiplication for machine learning-based autonomous systems

Autonomous systems execute complex tasks to perceive the environment and take self-aware decisions with limited human interaction. This autonomy is commonly achieved with the support of machine learning algorithms. The nature of these algorithms, that need to process large data volumes, poses high-performance demands on the underlying hardware. As a result, the embedded critical real-time domain is adopting increasingly powerful processors that combine multi-core processors with accelerators such as GPUs. The resulting hardware and software complexity makes it difficult to demonstrate that the system will run safely and reliably. This is the main objective of functional safety standards, such as IEC 61508 or ISO 26262, that deal with the avoidance, detection and control of hardware or software errors. In this paper, we adopt those measures for the safe inference of machine learning libraries on multi-core devices, two topics that are not explicitly covered in the current version of standards. To this end, we adapt the matrix-matrix multiplication function, a central element of existing machine learning libraries, according to the recommendations of functional safety standards. The paper makes the following contributions: (i) adoption of recommended programming practices for the avoidance of programming errors in the matrix-matrix multiplication, (ii) inclusion of diagnostic mechanisms based on widely used checksums to control runtime errors, and (iii) evaluation of the impact of previous measures in terms of performance and a quantification of the achieved diagnostic coverage. For this purpose, we implement the diagnostic mechanisms on one of the ARM R5 cores of a Zynq UltraScale+ multi-processor system-on-chip and we then adapt them to an Intel i7 processor with native code employing vectorization for the sake of performance.

Safe and secure software updates on high-performance mixed-criticality systems: The UP2DATE approach

Over-The-Air Software Updates (OTASU) are gaining popularity on the safety-critical domain. The motivation behind this trend is twofold. On the one hand, the ability of adding new functionality and services to the system without a complete redesign makes product makers more competitive and improves user experience. On the other hand, the increasing connectivity of emerging embedded devices makes OTASU a crucial cyber-security demand to keep the system up-to-date with latest security patches. However, the application of OTASU in the safety-critical domain is not straightforward, as they are not contemplated by current functional safety standards. The UP2DATE European H2020 project, seeks to provide solutions to cope with the challenging requirements of safety and security standards with respect to software updates. This paper gives an overview of UP2DATE, its foundations and the initial description of its safe and secure architecture that builds around composability and modularity on heterogeneous high-performance platforms.

The Importance of Interoperability in Functional Safety Standards

The Importance of Interoperability in Functional Safety Standards

Time and Area Optimized Testing of Automotive ICs

As cars become increasingly computerized and their safety functions evolve rapidly, the number of complex safety-critical components deployed in advanced driver assistance systems or autonomous vehicles is rising dramatically with high-end models containing hundreds of embedded microcontrollers. These integrated circuits must adhere to stringent requirements for high quality and long-term reliability driven by functional safety standards. This requires test solutions that address challenges posed by automotive systems. This article presents a scan-based test scheme optimizing test time and area overhead during manufacturing and in-system test of automotive electronics. The proposed scheme deploys observation test points that capture the faulty effects in every shift cycle into separate observation scan chains. To reduce area overhead, the scheme enables the sharing of flip-flops among control points. It is also shown how test points enhance test coverage (TC) in the presence of cascaded clock gaters. Finally, processing challenges when fault simulating every scan shift cycle to determine TC are addressed. Experimental results obtained for contemporary automotive designs and reported herein show significant improvements in test quality over traditional solutions.

On-line self-test mechanism for Dual-Core Lockstep System-on-Chips

The Dual-Core Lockstep configuration is largely employed in safety-critical System-on-Chips for the sake of compliance with functional safety standards. Such configuration includes two processor cores paired together, always fed with the same identical inputs and their outputs are continuously compared by a set of comparators. However, permanent faults affecting the comparators may invalidate the system functionalities, thus in-field self-test mechanisms are mandatory. In this paper, different in-field self-test solutions are first discussed. Then, a hybrid hardware-software scheme for the on-line testing of the lockstep logic is proposed. Such a solution leverages test programs developed according to the Software-Based Self-Test (SBST) approach, used in conjunction with a specialized hardware module. The effectiveness of this approach was assessed on a modified version of the OpenRISC 1200 processor. Exhaustive experiments demonstrated that it is possible to achieve a fault coverage of stuck-at faults greater than 99%, while at the same time significantly reduce the area overhead of classical approaches.