Advanced driver assistance systems (ADAS) and automated driving functions are the most complex automotive systems today. They span multiple ECUs, sensors and actuators and need to integrate different, sometimes counteracting requirements. On top of this comes their safety-criticality, both in terms of functional safety (FuSa) (failure-related) and safety of the intended functionality (SOTIF) (performance-related). Model-based systems engineering (MBSE) with tightly integrated iteration loops over safety analysis and simulation can provide a solution. However, there is no "cook-book" how to practically integrate all these different work steps into one efficient workflow. We report on an internal case study we have made using an Advanced Emergency Braking System (AEBS), from which a complete MBSE/MBSA workflow was derived for its application in industry-grade developments.

Nach vorherrschender Meinung veranschaulicht Platon im Gorgias die Wirkungslosigkeit der Sokratischen Gesprächsmethode, da er Sokrates vor allem heftige Vorwürfe und Spott ernten lässt.

Component Fault Trees (CFTs) were invented in 2003 as a compositional extension to fault trees to better reflect the technical architecture of a system in its safety analysis model. Since then, a lot of research has been contributed regarding semantic extensions, evaluation techniques, and tighter linking between system and safety models. This paper addresses three main objectives. First, we summarize the most important contributions and shape a vision of better integrated system modeling and safety analysis. Second, we push forward standardization and sketch a new evaluation scheme for quantitative analysis using mdd. Lastly, an outlook on future improvement ideas is given to make CFTs a viable technique for loosely coupled systems and Cyber-Physical Systems.

In these days, we encounter the transition from traditional closed and restricted-purpose embedded systems towards networked Cyber-Physical Systems. This applies to many industries, but in particular to the automotive industry, where assistance and automated driving functions are shaped out of complex combinations of functions and electronic control units, and even the car as a whole becomes part of a larger network of many vehicles plus infrastructure. Still, veriĄable assertions must be available in the end to satisfy the safety case. The speciĄcation skills in industry often turn out to be insufficient. Even today, the mandatory V-model is hard to apply in practice and expressing appropriate requirements and reĄnements along with the evolution of the architecture is a hard thing to do. When development becomes agile and centered around component reuse, things become even more complex. We report about our experience with the application of contract-based development and explain keystones of our approach. We present a new template language called SSPL that allows the speciĄcation of requirements and assertions on every system architecture level and show how contract-based requirements reĄnement can go hand in hand with architecture reĄnement in SysML. We further present our Eclipse-based tool SAVONA that enables practical application of the approach.

Automated cooperation is arriving in practice, for instance in vehicular automation like platoon driving. The development and safety assurance of those systems poses new challenges, as the participating nodes are not known at design time; they engage in communication at runtime and the system behaviour can be distorted at any time by failures in some participant or in the communication itself. When running on a highway, simply switching off the function is not an option, as this would also result in hazardous situations. Graceful degradation offer a systematic approach to define a partial-order of less and less acceptable operation modes, of which the best achievable is selected in presence of failures. In this work we propose an approach for assurance of the degradation cascades based on mode-specific assertions, captured by assumption/guarantee contracts. More specifically, we share our experiences and methodology for specifying the contracts for both the nominal safe behaviour as well as the less safe but acceptable behaviour in presence of failures. Furthermore, we present an argument pattern for adequacy of the degradation cascades for meeting the global safety goals based on the contracts. We illustrate our approach by a car platooning case study.

Although the main concern of developers of Camera Monitor Systems (CMS) is usually about meeting the legal requirements and image quality demands, one should not forget that CMS are electronic systems with the potential to endanger vehicle safety, and therefore subject to a Functional Safety process according to the worldwide standard ISO 26262. Functional Safety is the discipline that systematically discusses hazards arising from malfunction of electronic or software-controlled systems in order to derive measures how to prevent or mitigate them. This chapter explains what hazards could arise in the context of CMS and how they are systematically investigated, and what follows during the remaining development process activities from Functional Safety point of view. Although the ISO 26262 standard is a quite complex work, consisting of 10 parts, this chapter invites the reader to take a tour to the most important cornerstones of the safety process, such as Item Definition, Hazard Analysis and Risk Assessment, Functional and Technical Safety Concept, Safety Analysis, and finally the Functional Safety aspects of design and verification activities. Although an exhaustive discussion of all facets of Functional Safety is not possible on a few pages, it is important to know what activities in general need to be planned for a CMS development project, and where expert consultancy is needed. The chapter ends with an outlook of potential extensions of CMS in the future, when they may become part of more advanced assistance and warning features.

The distributed design process for safety-critical embedded systems has become an increasingly difficult challenge: Electronic Control Units (ECUs) in vehicles, for instance, participate in many vehicle functions, while each vehicle function, in turn, is spread across several ECUs. Many suppliers participate in systems design and many partial functions are reused from past projects, not always knowing the assumptions at the time of their development. In particular, efficient allocation of safety mechanisms and a sound safety case are difficult tasks for original equipment manufacturers (OEMs). Contract-based development has gained popularity as an approach for supporting distributed development by explicitly annotating assumptions and guarantees to components, but an integrated process covering specification of nominal behavior and safety has not been described so far. We present such an integrated development approach that encompasses the systematic breakdown of nominal system behavior using contracts, the consistent derivation of safety analysis by interpreting several types of contract violations as a specification for failure modes, and the subsequent integration of safety mechanisms that cover these failure modes through safety contracts. The approach equally fits hardware and software and is therefore applicable on the system level. We demonstrate it by an electric drive example. The extensibility of our approach towards Cyber Physical Systems, which compose themselves at runtime, is briefly outlined at the end of the article.

Designing safety-critical cyber physical systems (CPS) was and remains a challenging task. CPS engineers are supposed to design solutions that are easy to modify, reusable, satisfy certification authorities, meet safety goals, separate between concerns, etc. With these partly contradicting demands it sometimes is even impossible to find a viable CPS design. The idea using contract-based design methods has been around for over two decades and enables automating the (re-)validation of the specification of CPS against the surrounding system or operational environment. In this work we extend the notion of contracts by component and interface contracts and give ideas on how to integrate them in a modular safety assurance approach. The explicit separation between these two types of contracts also better reflects the separation of concerns and reduces the overall modeling effort. We evaluate our approach with an automotive E-Drive case study.

Complex automotive systems are composed of subsystems and components in a deep hierarchy, often designed by different development partners or reused from preexisting projects. It is therefore a challenging task to break down requirements into sub-requirements fitting the scope of the subsystems and to simultaneously demonstrate that the integrated system fulfills both functional and safety requirements specified on the top-level. Contract-based development is a popular approach for breaking down requirements onto components by means of assumptions and guarantees. However, most current approaches are based on a formal semantics and therefore limited in their expressive power and their acceptance by practitioners from automotive industries. We propose a semi-formal approach that allows specifying assumptions and guarantees at component interfaces in a language with well-defined syntax, but leaving the verification of fulfillment of the contract by a component to expert decision. However, some of the relevant refinement relations can be formalized and automatically checked. We describe our prototypical Eclipse tool that allows the annotation of components with assumptions and guarantees, and the partial checking of the decomposition. We show the applicability by a case study of an automotive electric drive system.

Failure Mode and Effects Analysis (FMEA) is one of the most widely used techniques for identifying risks in complex technical systems. It is a mandatory practice in most safety-critical domains. Initially, FMEA was a tabular technique, listing potential failures with their possible effects, thereby suggesting a cause-effect relationship. In later years, it had been extended towards a graphical technique enabling a display of the cause-effect relationships across several hierarchy levels in the form of failure nets (FN). Later approaches and FMEA software tools suggest the use of logical operations to model OR and AND combinations of single and multiple failures in FN, but an underlying formalism is still missing. Also, there is no general consensus whether FN are suited to represent the actual causality between failure events or just represent logical conjunctions of fault states. Moreover, as there is no feature to weight FN-edges, it is not possible to express the likelihood of potential failure consequences, which may result in overly conservative estimates. A potential solution is to assign conditional probabilities to the edges of FN. Next, it is not straightforward to model the functional interaction of mechanisms at operation time which prevent cause-effect-chains from evolving, for example by safety-related functions that counteract the failure consequences. Such detection mechanisms may bring the system into a safe state and potentially cover several faults originating from different components, thereby influencing the probability of the failure consequences. But the application of FMEA to systems in which safety measures typically are implemented, e.g. software-determined systems, is not sufficiently solved yet. At last, the restricted compatibility with other techniques as the FMEDA or FTA keeps databases and cognition in separate slots, which increases the risk of inconsistencies and hampers the integration of analyses from different suppliers. To overcome these drawbacks, we propose a semantic underpinning to FMEA that (1) includes fault conditions and failure events, (2) reflects the propagation of failures between components at different architecture hierarchy levels, (3) refers to the causal meaning of FN-edges, (4) allows for the assignment of conditional probabilities to these edges and (5) provides extended logical combinations for FN along with a specific notation. We present appropriate calculation laws and show the compatibility to common rules of related techniques such as Fault Trees and FMEDA. The application of this probabil-istically extended FMEA technique is demonstrated by a practical example taking the modeling of safety mechanisms into account. A. C. …

For a long time risks of manipulation protection and data protection of vehicle electronics could be considered relatively uncritical. Due to the wireless technology and internet connectivity of the vehicle electronics new risks arise that may affect the safety of the entire vehicle and passengers. Berner & Mattner provides an overview on the required formalisation of the security process and gives an outlook on the coordination of measures for the configuration, data and access protection (security engineering) with those of functional safety (safety engineering).

Increasing enforcement of safety standards – such as the new ISO 26262 – requires developers of embedded systems to supplement their development processes with safety-related activities, such as hazard analysis or creation of technical safety concepts. Since these activities are often only loosely coupled with core development tasks, their addition reduces efficiency and causes a lack of consistency and traceability. This paper presents an approach to the integration of architectural modelling, modelling of failure nets, allocation safety mechanisms to architectural elements, and finally traceability to requirements and test coverage. The presented methodology gives clear instructions for the comprehensive usage of existing techniques. The process is demonstrated using a real-world example from the automotive sector. In two industrial projects a significant increase of productivity could be achieved, solely using standard tools such as DOORS and IQ-RM. Nevertheless, the paper concludes with some suggestions for further enhancement of the method through formalization, e.g. using SysML, and tool integration.