Fail-operational Safety Architecture for ADAS/AD Systems and a Model-driven Approach for Dependent Failure Analysis (eBook)

Preface 6
Contents 7
Figures 9
Tables 13
Abbreviations 14
Abstract 16
Kurzfassung 18
1 Introduction 20
1.1 Motivation and Objectives 20
1.2 Thesis Outline 23
2 State of the Art 25
2.1 Functional Safety 25
2.2 ISO 26262 - Road Vehicles - Functional Safety 26
2.2.1 Safety Lifecycle 28
2.2.2 ASIL Decomposition 32
2.2.3 Analysis of Dependent Failures (DFA) 33
2.2.4 Freedom From Interference (FFI) 35
2.3 ISO/PAS 21448 – Safety of the Intended Functionality 36
2.4 SAE J3016 - Automated Driving Levels 38
2.5 Multicore Processors / Domain ECUs 39
2.6 Architecture Description Language / EAST-ADL 41
2.6.1 System Model of EAST-ADL 42
2.6.1.1 Vehicle Level 43
2.6.1.2 Analysis Level 44
2.6.1.3 Design Level 44
2.6.1.4 Implementation Level 46
2.6.2 Dependability Model and Requirements Model of EAST-ADL 47
2.6.2.1 Dependability Model 47
2.6.2.2 Requirements Model 47
3 Fail-operational Safety Architecture for ADAS/AD Systems 49
3.1 Introduction 50
3.2 Safety Architecture Mechanisms 52
3.2.1 Fail-safe Safety Architecture 52
3.2.2 Fail-operational Safety Architecture 52
3.2.2.1 1-out-of-2 Safety Architecture (1oo2): 53
3.2.2.2 2-out-of-3 Safety Architecture: 53
3.2.2.3 2-out-of-2 Safety Architecture: 54
3.2.2.4 2-out-of-2 PD Safety Architecture: 55
3.3 Fail-operational Safety Architecture for Conventional Systems 56
3.4 Fail-Operational Safety Architectures for ADAS/AD Systems 58
3.4.1 Fail-operational Safety Approach for ADAS/AD Systems 60
3.4.1.1 Sensor Redundancy / Mapping of Functions to Sensors: 62
3.4.1.2 Electronic Control Unit Redundancy / HW Redundancy: 63
3.4.1.3 Intelligent Fail-operational Fallback Strategy to Achieve Minimum Risk Condition 69
3.4.2 ASIL Decomposition for ADAS/AD Systems 74
3.4.2.1 ASIL Decomposition in General 74
3.4.2.2 ASIL Decomposition for ADAS/AD Systems 75
3.4.3 Dependent Failure Analysis for ADAS/AD Systems 82
3.5 Use Cases 84
3.5.1 Fail-operational Safety Architecture for Powertrain Domain 84
3.5.2 ASIL Decomposition in General 85
3.5.3 ASIL Decomposition for AD Systems 87
3.6 Conclusion 92
4 Model-driven Approaches for ISO 26262 Work Products and DFA 94
4.1 Development of Safety Functions Using Modified EAST-ADL 94
4.1.1 Introduction 94
4.1.2 Description of the Approach 96
4.1.3 Extensions of EAST-ADL 99
4.1.3.1 Extensions of EAST-ADL Abstraction Level: 99
4.1.3.2 Extensions of EAST-ADL Dependability Model: 99
4.1.3.3 Extensions of EAST-ADL Requirements Model: 101
4.1.3.4 Model Based Safety Analysis: 104
4.1.3.5 Simulation 105
4.1.4 Use Case 106
4.1.5 Conclusion 113
4.2 A Model-driven Approach for DFA Using Modified EAST-ADL 115
4.2.1 Introduction 116
4.2.2 DFA According to ISO 26262 117
4.2.2.1 Approach of System and Safety Modeling 117
4.2.2.2 Requirements for DFA 117
4.2.3 Necessary Developments of EAST-ADL for the DFA 121
4.2.4 Description of Developed Model-based Approach for DFA and Safety Analysis 127
4.2.5 Scripts and Reports 135
4.2.6 Use case 138
4.2.6.1 Dependability Model / HARA: 139
4.2.6.2 Requirements Model: 140
4.2.6.3 Functional Analysis Architecture (FAA): 141
4.2.6.4 Functional Design Architecture (FDA): 142
4.2.6.5 Hardware Design Architecture (HDA): 143
4.2.6.6 FDA/HDA Allocation: 144
4.2.6.7 DFA Checks: Relation Check – Rule Violations: 146
4.2.6.8 DFA Checks: ASIL Check – Rule Violations: 147
4.2.6.9 DFA Checks: Independency Check – Rule Violations: 148
4.2.6.10 DFA Checks: Signal Check – Rule Violations: 150
4.2.7 Conclusion 154
5 Conclusion and Outlook 155
Bibliography 159