ISO 26262 is a Functional Safety standard, titled "Road vehicles – Functional safety".
Overview Functional safety features form an integral
part of each automotive product development phase, ranging from the specification, to
design, implementation, integration, verification, validation, and production release. The standard
ISO 26262 is an adaptation of the Functional Safety standard IEC 61508 for Automotive Electric/Electronic
Systems. ISO 26262 defines functional safety for automotive equipment applicable throughout
the lifecycle of all automotive electronic and electrical safety-related systems.
The first edition, published on 11 November 2011, is intended to be applied to electrical
and/or electronic systems installed in "series production passenger cars" with a maximum
gross weight of 3500 kg. It aims to address possible hazards caused by the malfunctioning
behaviour of electronic and electrical systems. The standard consists of 9 normative parts
and a guideline for the ISO 26262 as the 10th part.
Like its parent standard, IEC 61508, ISO 26262 is a risk-based safety standard, where the
risk of hazardous operational situations is qualitatively assessed and safety measures
are defined to avoid or control systematic failures and to detect or control random hardware
failures, or mitigate their effects. Provides an automotive safety lifecycle and
supports tailoring the necessary activities during these lifecycle phases.
Covers functional safety aspects of the entire development process.
Provides an automotive-specific risk-based approach for determining risk classes.
Uses ASILs for specifying the item's necessary safety requirements for achieving an acceptable
residual risk. Provides requirements for validation and confirmation
measures to ensure a sufficient and acceptable level of safety is being achieved.
VDC Research reports that adherence to ISO 26262 and AUTOSAR is expected to increase
significantly in the next two years. Therefore, many functional safety service providers,
have created training programs to help understand the various safety processes as well as legal
responsibilities and what is involved to achieve compliance.
The ten parts of ISO 26262: Vocabulary
Management of functional safety Concept phase
Product development at the system level Product development at the hardware level
Product development at the software level Production and operation
Supporting processes Automotive Safety Integrity Level-oriented
and safety-oriented analysis Guideline on ISO 26262
Vocabulary ISO 26262 specifies a vocabulary of terms,
definitions, and abbreviations for application in all parts of the standard. Of particular
importance is the careful definition of fault, error, and failure as these terms are key
to the standard’s definitions of functional safety processes, particularly in the consideration
that "A fault can manifest itself as an error ... and the error can ultimately cause a failure".
Item Within this standard, item is a key term.
Item is used to refer to a specific system or array of systems that implements a function
at the vehicle level to which the ISO 26262 Safety Life Cycle is applied. That is, the
item is the highest identified object in the process and is thereby the starting point
for product-specific safety development under this standard.
Element System or part of a system, including components,
hardware, software, hardware parts, and software units -- effectively, anything in a system
that can be distinctly identified and manipulated. Fault
Abnormal condition that can cause an element or an item to fail.
Error Discrepancy between a computed, observed or
measured value or condition, and the true, specified or theoretically correct value or
condition. Failure
Termination of the ability of an element to perform a function as required.
Note: Since an element's specification defines its required function, the standard recognizes
incorrect specification as a potential a source of failure.
Malfunctioning Behaviour Failure or unintended behaviour of an item
with respect to its design intent. Hazard
Potential source of harm caused by malfunctioning behaviour of the item.
Functional Safety Absence of unreasonable risk due to hazards
caused by malfunctioning behaviour of Electrical/Electronic systems.
Note: In contrast to the formal vocabularies defined for other Functional Safety standards,
Fault Tolerance is not explicitly defined within this standard -- it is assumed impossible
to comprehend all possible faults in a system. Functional Safety rather than Fault Tolerance
is the objective of the standard. ISO 26262 does not use the terms SFF and hardware fault
tolerance. The terms single point faults metric and latent faults metric are used instead.
Functional Safety Management ISO 26262 provides a standard for functional
safety management for automotive applications, defining standards for overall organizational
safety management as well as standards for a safety life cycle for the development and
production of individual automotive products. The ISO 26262 safety life cycle described
in the next section operates on the following safety management concepts:
Hazardous Event A hazardous event is a relevant combination
of a vehicle-level hazard and an operational situation of the vehicle with potential to
lead to an accident if not controlled by timely driver action.
Safety Goal A safety goal is a top-level safety requirement
that is assigned to a system, with the purpose of reducing the risk of one or more hazardous
events to a tolerable level. Automotive Safety Integrity Level
An Automotive Safety Integrity Level represents an automotive-specific risk-based classification
of a safety goal as well as the validation and confirmation measures required by the
standard to ensure accomplishment of that goal.
Safety Requirement Safety requirements include all safety goals
and all levels of requirements decomposed from the safety goals down to and including
the lowest level of functional and technical safety requirements allocated to hardware
and software components. Safety Life Cycle
Processes within the ISO 26262 safety life cycle identify and assess hazards, establish
specific safety requirements to reduce those risks to acceptable levels, and manage and
track those safety requirements to produce reasonable assurance that they are accomplished
in the delivered product. These safety-relevant processes may be viewed as being integrated
or running in parallel with a managed requirements life cycle of a conventional Quality Management
System: An item is identified and its top level system
functional requirements are defined. A comprehensive set of hazardous events are
identified for the item. An ASIL is assigned to each hazardous event.
A safety goal is determined for each hazardous event, inheriting the ASIL of the hazard.
A vehicle level functional safety concept defines a system architecture to ensure the
safety goals. Safety goals are refined into lower-level
safety requirements. (In general, each safety requirement inherits
the ASIL of its parent safety requirement/goal. However, subject to constraints, the inherited
ASIL may be lowered by decomposition of a requirement into redundant requirements implemented
by sufficiently independent redundant components.) "Safety requirements" are allocated to architectural
components (In general, each component should be developed
in compliance with standards and processes suggested/required for the highest ASIL of
the safety requirements allocated to it.) The architectural components are then developed
and validated in accord with the allocated safety requirements.
Automotive Safety Integrity Level See also Comparison of ASIL with Other Hazard
Level Standards Automotive Safety Integrity Level refers to
an abstract classification of inherent safety risk in an automotive system or elements of
such a system. ASIL classifications are used within ISO 26262 to express the level of risk
reduction required to prevent a specific hazard, with ASIL D representing the highest and ASIL
A the lowest. The ASIL assessed for a given hazard is then assigned to the safety goal
set to address that hazard and is then inherited by the safety requirements derived from that
goal. ASIL Assessment Overview
The determination of ASIL is the result of hazard analysis and risk assessment. In the
context of ISO 26262, a hazard is assessed based on the relative impact of hazardous
effects related to a system, as adjusted for relative likelihoods of the hazard manifesting
those effects. That is, each hazardous event is assessed in terms of severity of possible
injuries within the context of the relative amount of time a vehicle is exposed to the
possibility of the hazard happening as well as the relative likelihood that a typical
driver can act to prevent the injury. ASIL Assessment Process
At the beginning of the safety life cycle, hazard analysis and risk assessment is performed,
resulting in assessment of ASIL to all identified hazardous events and safety goals.
Each hazardous event is classified according to the severity of injuries it can be expected
to cause: Severity Classifications:
S0 No Injuries S1 Light to moderate injuries
S2 Severe to life-threatening injuries S3 Life-threatening to fatal injuries
Risk Management recognizes that consideration of the severity of a possible injury is modified
by how likely the injury is to happen; that is, for a given hazard, a hazardous event
is considered a lower risk if it is less likely to happen. Within the hazard analysis and
risk assessment process of this standard, the likelihood of an injurious hazard is further
classified according to a combination of exposure and
control. Exposure Classifications:
E0 Incredibly unlikely E1 Very low probability
E2 Low probability E3 Medium probability
E4 High probability Controllability Classifications:
C0 Controllable in general C1 Simply controllable
C2 Normally controllable C3 Difficult to control or uncontrollable
In terms of these classifications, an "Automotive Safety Integrity Level D" hazardous event
is defined as an event having reasonable possibility of causing a life-threatening or fatal injury,
with the injury being physically possible in most operating conditions, and with little
chance the driver can do something to prevent the injury. That is, ASIL D is the combination
of S3, E4, and C3 classifications. For each single reduction in any one classification
from its maximum value, there is a single level reduction in the ASIL from D. [For example,
a hypothetical uncontrollable fatal injury hazard could be classified as ASIL A if the
hazard has a very low probability.] The ASIL level below A is the lowest level, QM. QM
refers to the standard's consideration that below ASIL A, there is no safety relevance
and only standard Quality Management processes are required.
These Severity, Exposure, and Control definitions are informative, not prescriptive, and effectively
leave some room for subjective variation or discretion between various automakers and
component suppliers. In response, the Society for Automotive Safety Engineers is drafting
J2980 – Considerations for ISO26262 ASIL Hazard Classification to provide more explicit
guidance for assessing Exposure, Severity and Controllability for a given hazard.
See also Automotive Safety Integrity Level, comparison
with other safety level systems ARP4754
IEC 61508 Time-triggered system
References
External links ISO 26262-1:2011(en) at ISO Online Browsing
Platform