Automotive safety: An ISO 26262 perspective

Benefits of ISO 26262
Implementing ISO 26262 ensures that a high level of safety is built into car components right from the start. The standard can be used to establish a safety management system based on internationally recognized best practices and the latest approach to risk management, giving you a competitive edge. It is expected that car manufacturers will use compliance to ISO 26262 as a means to qualify components and potential suppliers of E/E components.

What is ISO 26262?

ISO 26262 is a multipart standard defining requirements and providing guidelines for achieving functional safety in E/E systems installed in road vehicles. The standard ISO 26262 is considered a best practice framework for achieving functional safety in road vehicles.

Scope of ISO26262

- Hardware/Software such as electric/electronic devices
- Parts or systems that may significantly impact on human lives in case of malfunction/failure are considered.
- Equipment that consists only of machinery is out of its scope
- The entire Life-Cycle of automotive products
- Motor vehicles up to 3500kg
- The entire Life-Cycle of automotive products

The framework provided by ISO 26262 deals with the functional safety of:

Products. The standard requires a safety case and a number of confirmation measures to be applied during the product lifecycle
Processes. The standard requires specific life cycle processes to be implemented within a safety management system driven by a risk-based approach.

Safety has been a key aspect in the automotive industry even from its earliest stages, but the importance with which it is regarded has become far greater in recent times. Currently the biggest compound annual growth rate (CAGR) in automotive electronics revenue can be attributed to safety applications. Increasingly car manufacturers are making safety a key selling point with which to differentiate themselves from their competition. But with a growing amount of electronics content making up a car's bill of materials, there is now a necessity to switch from the long-established best practices approach to well-defined universal guidelines. As a result, industry protagonists have joined forces to develop a standard with far-reaching implications.

The word "safety" is subject to various different interpretations. However, when applied to modern automobile design it can generally be categorized using the following structure:

1. Passive safety: Assuming that an accident is effectively inevitable, the aim of passive safety mechanisms is to minimize the severity of that accident. The passive safety elements found within a vehicle include seatbelts, crumple zones, etc.
2. Active safety: The systems that are concerned with active safety (based on the knowledge of the current state of the vehicle) will aim to avoid accidents altogether in addition to the minimization of its effects if an accident occurs. Seatbelt pre-tensioning, airbag deployment, predictive emergency braking, anti-lock braking systems and traction control are all examples of this.

3. Functional safety: This focuses on ensuring that all of the electrical and electronic systems (such as power supplies, sensors, communication networks, actuators, etc), including (but not limited to) all ;active safety related systems, function correctly. Functional safety is dealt with by the ISO-26262 standard (published in November 2011).

Structure of ISO 26262:

It is important to state from the beginning that functional safety does not mean that there is no risk of a malfunction taking place -- instead, functional safety implies the absence of unacceptable risk due to hazards caused by malfunctioning behavior of electrical and electronic systems.

Electronic systems carry out many functions in modern automobiles, including driver assistance functions, vehicle dynamics control, and active/passive safety systems. The complexity of electronically-driven operations, especially safety functions, makes predicting safety performance extremely difficult. More action will be required, furthermore, to reduce the risks of systematic and random hardware failures as system complexity continues to increase.
ISO 26262 is a functional safety standard intended to be applied to the development of software for electrical and/or electronic (E/E) systems in automobiles. ISO 26262 is an adaptation of the broader IEC 61508 safety standard, which has been used to derive safety standards for the nuclear power, machinery, railway, and other industries. It is aimed at reducing risks associated with software for safety functions to a tolerable level by providing feasible requirements and processes.

ISO 26262 Software Compliance: Achieving Functional Safety in the Automotive Industry

Introduction: Functional Safety In The Automotive Industry

About ISO 26262

ISO/DIS 26262 is the adaptation of IEC 61508 to comply with needs specific to the application sector of E/E systems within road vehicles. ISO 26262 covers functional safety aspects of the entire development process (including such activities as requirements specification, design, implementation, integration, verification, validation, and configuration). The standard provides guidance on automotive safety lifecycle activities by specifying the following requirements:

Functional safety management for automotive applications
The concept phase for automotive applications
Product development at the system level for automotive applications Software architectural design
Product development at the hardware level for automotive applications Software unit testing
Product development at the software level for automotive applications
Production, operation, service and decommissioning
Supporting processes: interfaces within distributed developments, safety management requirements, change and configuration management, verification, documentation, use of software tools, qualification of software components, qualification of hardware components, and proven-in-use argument.
Automotive Safety Integrity Level (ASIL)-oriented and safety-oriented analyses

What ISO 26262 Does Not Cover

Unique E/E systems in special purpose vehicles such as vehicles designed for drivers with disabilities
Hazards related to electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, corrosion, release of energy and similar hazards, unless directly caused by malfunctioning behavior of E/E safety-related systems
Nominal performance of E/E systems

Specific Software Development Sections In ISO 26262

Part 6 of the standard specifically addresses product development at the software level. Requirements for the following development activities are specified:

Initialization of product development
Specification of software safety requirements
Software architectural design
Unit design and implementation
Unit testing
Software integration and testing
Verification of software safety requirements.

What is functional safety in accordance with ISO 26262 standard?

ISO 26262 focuses on the functional safety of electrical and electronics (E/E) systems in vehicles. Functional safety in accordance with ISO 26262 affects all systems containing electrical and electronic or electromechanical components, i.e systems from the fields of actuators and sensor technology as well as control electronics. Functional safety is concerned with the absence of unreasonable risk to individuals caused by potential malfunction in E/E systems. Functional safety is therefore considered a system property.

Example for Functional Safety:

Need for internal expertise

Functional safety is a complex topic
Functional safety standards are difficult to master

Further challenges

ISO26262 can lead to multiple interpretations
Many companies/consultants were (and still are) very much IEC61508 focused
But automotive has different constraints to consider
Often concept of safety, availability and reliability are mixed up – “It must always work. Then needs to comply to ISO26262!”
ISO26262 terminology is still often read with IEC61508 “eyes” leading to many misunderstanding.

Example – IEC61508: Item is an element of the final Control System –ISO26262: Item is the final system at vehicle level

Based on the functional safety concept,the technical safety concepts are derived.
– The technical safety requirements are mapped to system elements which are hardware
or software based.

If a system component fails:

means need to be specified which will detect the failure (self control) and
a reaction needs to be present which wil ltransition the system into a safe state.
After hardware and software development,there is hardware and software integration, followed by system integration and vehicle integration.