How can we deal with the concept phasein the functional safety standard forautomobiles

Nil Software Corp.
Masao Ito

SSS 2016
3/Feb/2016

1

Useless concept phase ?!
擦り合わせ (Su-ri-awa-se)• People in the automobile field always say that there is nochance to develop an item from scratch. Because currently themost important activity is Su-ri-awa-se (closely coordination). And
they sometimes set aside the importance of the concept phase.
• But, I think we will have to think the new systems in the future
automated driving car. In that time, I believe we need thecoherent approach for establishing safety in the new car.

SSS 2016
3/Feb/2016

2Example• I use CACC as an example to explain our approach– CACC is an enhancement of ACC that enables more accurate
gap control and operations at smaller gaps by adding
communication using the forward vehicle information. In this type,
we use the LIDAR for recognition of the target car

communication(image) recognition
clearance
Simple image of CACC (it has two mechanism to get the forward car information)
CACC: Cooperative Adaptive Cruise Control
SSS 2016
3/Feb/2016

3Concept phase ?
• Part 3 of ISO 26262 is for the concept phase.
• This phase has four sub-phases:– Item definition– Initiation of software lifecycle– Hazard analysis and risk assessment (HARA)– Functional safety concept

SSS 2016
3/Feb/2016

4

Where is the Concept Phase ?
• It is the first phase in the development process
ISO 26262-2:2011(E)– from item definition (3-5) to functional safety concept (3-8)
2-5 to 2-7

Item definition

3-6

Initiation of thesafety lifecycle
Hazard analysis

3-7 and risk assessment

7-6

Operationplanning

7-5Productionplanning

3-8

Functional safetyconcept4

Product development:
system level

5HWlevel

4-96SWlevel

Allocation
to othertechnologies

Safety validation

Controllability

Externalmeasures

Product development

Here

3-5

Concept phase

Management of functional safety

Functional safety(ISO 4-1026262assessment
Part 2 Figure 2)
SSS 2016
3/Feb/2016

4-11

Releasefor production

5

five issues• Item ?
• Safety activity and other development activity• Finding Hazards• How to calculate the controllability for ASIL
• Several “times”

SSS 2016
3/Feb/2016

6item ?
• The item is not a system. It is an
abstract object, and a system isgenerated from the item.
– e.g.
– The auto-cruise control system isan item
– The ACC in the toyota camry is asystem• As for system, we have many
analyzing method. But I think
there is no good approach of theitem.
ISO 26262 Part 10 Fig. 3
SSS 2016
3/Feb/2016

7

Item Sketch• We use the item sketch to represent the static and dynamic
model of an item
– As the static representation, we use the type model of catalysis (, but uml
class model is enough in this phase)– As the dynamic model, we can use the statechart as a finite statemachine
TypeCACCSimpleRecognition
0..1

ForwardCar
0..1

Recognise	  	  by	  LIDAR

1SelfCar

Recognise	  	  by	  Comm.
1

LIDAR

1Comm.	  Device

Example of static item sketch
SSS 2016
3/Feb/2016

8

Item Sketch

ダイアグラム名

プロジェクト名 26262_example_A

ダイアグラム名

Curuise Control ON
Curuise Control ON

CACC_Control（in the broad sense）
CACC_Control（in the broad sense）

CACC

CACC
[ TargetNOTRecognizedByImage ]TargetIdentified[ CACCselectedByUser ]CCC

TargetIdentified[ CACCselectedByUser CC_ON]

CCC

CACC

StandBy

TargetLost||Cancel / Transition

StandBy

Cruise Control OFF[ TargetNOTRecognizedByImage ]StandBy

NoIdentifiedCars [ AfterTmsec ] / Transition
StandBy

CC_OFF[ SatisfiedSpeedCondition ]CACC
ACC_CCC_Breakdown

By

UserInteraction||Cancel / Transition[ ACCselectedByUser ]TargetLost||Cancel / Transition

CACC_breakdown / Transition
CCC Control

ACC

NoIdentifiedCars [ AfterTmsec ] / Transition

StandBy

TargetIdentified
StandBy
ACC

TargetLost||Cancel / Transition[ ACCselectedByUser ]NoIdentifiedCars [ AfterTmsec ] / Transition[ SatisfiedSpeedCondition ]UserInteraction||Cancel/ Transition[ TargetNOTRecognizedByImage ]CACC_breakdown / Transition
ACC

SSS 2016
3/Feb/2016

TargetIdentified
StandBy

CCC Control

9

five issues• Item ?
• Item sketch (static & dynamic model)• Safety activity and other development activity• Finding Hazards• How to calculate the controllability for ASIL
• Several “times”

SSS 2016
3/Feb/201610

Safety activity and other development
activity• No separation– ISO 26262 is the standard for functional safety. We would like tolocate it in the whole development process, because in the earlyphase (i.e. concept phase) it is hard to divide it into thedevelopment and safety activity– Solution: Goal Model– To consolidate the requirements in the abstract level, we use theKAOS approach– (Obstacle node is a candidate of hazard)

SSS 2016
3/Feb/2016

11

Goal model

The goal of an item is the top goal. We decompose it into the sub262_example_A
Diagram Name CACC top goal model
goals. We can also write the non-functional
requirement, for example,
as a soft goal•

Keep safe distance with inter-vehiclecommunication

Goal Node

LIDAR may be
used also in ACC
systemRecognise theforward car by
LIDAR

This softgoal

attribute of aAnd Connection"communicatother cars"

Continuously
identify theforward car

Communicate withother cars

Find cars that self
car cancommunicate withThis calculation will bedone aside from ACC andCC calculation

Make final identificationof forward car using
LIDAR and comm.

Calculate the driving(braking) force

Calculate thespeed of self car

Arbitrate the self andother system's output

Calculate therelative speed
using info from ...

No fals
inter-v
commu

Calculate thedriving (braking)force

Maintaincommunication
with forward car

example of goal modeling by goal decomposition
SSS 2016
3/Feb/2016

Can NOT recognize theforward car

12

five issues• Item ?
• Item sketch (static & dynamic model)• Safety activity in the whole development process• Use goal model• Finding Hazards• How to calculate the controllability for ASIL
• Several “times”

SSS 2016
3/Feb/2016

13

Finding Hazards• The item is an abstract object and it is not a system• So, It is hard to use the conventional method (such as FTA).
Here	  !

Itemrealization

Not	  in	  concept	  phase

Function

Sytem

Component

HW-Part
SW-Unit
SSS 2016
3/Feb/2016

14

Finding Hazards• We use the description of a goal, it is compromising semi-formal
approach– Because,• In concept phase, it is hard to describe the formal model• But, the graphical representation of item sketch (UML and specificationtype) help us to think correctly.

– If sentence consist of <Subject> <Verb> <Object>, we can write:• e.g. The subject car can recognize the car ahead by LIDAR.

– Insert the guide word (of HAZOP) or change the predicate/object.
– e.g. The subject car can NOT recognize the car ahead by LIDAR

Subject

SSS 2016
3/Feb/2016

PredicateObjectthe	  object	  is	  also	  the	  candidate	  “object”	  in	  the	  static	  item	  sketch
15

Finding Hazards• Use sentence in the goal node
• Apply the what-if question to the goal node
– e.g.: “recognize the forward car”
• (system) does NOT recognize the forward car• (system) is LATE to recognize the forward car

recognize theforward car

normally
recognize
the ...

[NOT]does NOT
recognise ...

[LATE]LATE torecognise ...

obstacle node

Goal VS. Obstacle
SSS 2016
3/Feb/2016

16

Finding Hazards•

Another method: item sketch is helpful to apply the what-if typequestion
ChangeCardinality

SelfCar

CACC
Speed

Time gap

ForwardCar
10..1

Keep time
gap

CalSpeed()
ModifySetSpeed()
ModifyTimeGap()

ChangeAttribute

ChangeActionRelativity
distance
relative speed
CalDistance()

SSS 2016
3/Feb/2016

ChangeResponsibility

Controller
warning status
BrakeCtrl()
EngineCtrl()

17

SSM
• Situation-Scenario Matrix– We can express the usage of an item by the scenario andthe situation.
•Example: CACC
– Road type
– Structure on the road– Neighboring car– Degree of jam– Climate visibility– Non-automobile perimeter objects– Regulation

SSS 2016
3/Feb/2016

18

SSM
• Example
Situations[A] SSMRoadStructure
Neighboring
Roadsituation category
CarAttrib.

State*A Scenario

Lane#CurvType*
LightiTime(HM:S)

GG(0), MU(0.8)1010:00
2↑

1012:00↑(m)ng

Guard State*
Front

Rear(m)(m)

RailDist.

situation attribute- RT̲SBY-↑ ↑Dist.

[A] SSM

Degree of JamStructure Climate/
Neighboring
Visibility
Car
Forwa
Lane#rd

Oppo
Curve Cross
Light- Weath
Guardsite(m)

*
ing

er*
Rail

Temp
Front

Visibili
Rear(m)

(m)
(deg)

(C)
Dist.

ty
Dist.

Perim
DegreeofActor (nonmoto Oppobike
Forwa
rdsiteGR(0),Y GG(0),30 MU(0.8)
202108-Y-

Y
CM̲
CS

30
28

20810082↑3020↑↑

↑

↑↑↑
↑

30
↑

20↑

↑
↑

↑
1GR(0),N GG(0),150MU(0.6)
200113-N-NCM̲
CS

150
28

20081030↑･･･GG(0), MU(0.6)1030:00
1*: appendix- RR̲CLN# in segment

seg# in#insegm

An Example SSM of CACC
SSS 2016
3/Feb/2016[B] 道路種[B] 道路種19

five issues• Item ?
• Item sketch (static & dynamic model)• Safety activity in the whole development process• Use goal model• Finding Hazards• guide words, Situation-Scenario Matrix (SSM)• How to calculate the controllability for ASIL
• Several “times”

SSS 2016
3/Feb/2016

20

ASIL and Controllability• We need three factors to calculate ASIL

BCACC
Scenario
Malfunction
SeverityExposureControllability

It comesfrom SSM

In highway, (AND) driving at high velocity in CACC mode
Identified, but there are differences in both information.
If this situation continues, controller may indicate the wrong time gap.
It may lead to crash with the forward car in larger
velocity than expected
E3: Highway
E4: High velocity
If driver notices the wrong behavior of CACC, hecan put on the brake and he can escape from theCACC control.

fromObstacle

S3
E3
C2

ASIL definition of an item
SSS 2016
3/Feb/2016

21

Controllability• Controllability is the “ability to avoid a specified harm ordamage through the timely reactions of the persons involved,possibly with support from external measures” (ISO26262 1-19)

How to calculate ?

SSS 2016
3/Feb/2016

22

Big Picture with driver and environment model• DESH-G schema covers the environment, driver and goal as wellas hardware and software.
ES

Software &Hardware

Environment
factors (road, traffic,weather ...)G

Goal
ScenarioH
Activity
Activity

ActionActionTASK_ATASK_ATASK_BTASK_B

DriverSSS 2016
3/Feb/2016

D

OP_A1
OP_A1
OP_A2
OP_A2
OP_B1
OP_B1

ACTV AACTV Adriver skill
driver state

Operation
Operation

OP_B2
OP_B2
OP_B3
OP_B3
OP_B4
OP_B4

23

Driving Difficulty：DD
Driving Difficulty (DD) is given by the difference between the value of Driver
Capability (DC) and the value of the Task Demand (TD) to achieve the driver goal.

⎧ fmrg (dc,td) - c th
fsafe (dc,td,cth ) = ⎨⎩0
fmrg (dc,td) = dc - td

when fsafe ≥ cthwhen fsafe < cthTD

INV : dc > td
dc : DC (Driver Capability)

DC1/fsafe

td : TD (Task Demand)
cth : threshold

CthSafe
SSS 2016
3/Feb/2016

Danger24

Safety vs Harm

Task Demand／Driver Capability

System Limit

Task Demand@ t = tn+1

D-zoneTask Demand@ t = tn

Hazardous
event occurred

Driver Capability@ t = tmbreak point for
accident

Driver Capability@ t = tm+1

degradationof drivercapability

Variation of Individuals

SSS 2016
3/Feb/2016

25

five issues• Item ?
• Item sketch (static & dynamic model)• Safety activity in the whole development process• Use goal model• Finding Hazards• Guide words, Situation-Scenario Matrix (SSM)• How to calculate controllability for ASIL
• Driver model, SSM• Several “times”

SSS 2016
3/Feb/2016

26

Several “times”• Functional Safety Requirement (FSR) has followings:a) operating modesb) fault tolerant time interval (FTTI)c) safe statesd) emergency operation interval, ande) functional redundancies (e.g. fault tolerance)

(2)

(2)
(1)

Points:(1)Abstract Functional Safety Mechanism(2)Flow Analysis and error description by AADL
SSS 2016
3/Feb/2016

27

FTTI & Emergency Operation Interval• Fault and Transition
Fault

Fault Detection

Transitioned to Safe State

NormalOperation

Possible Hazard(Safe State)
TimeT <= Diagnostic Test Fault Reaction TimeInterval
Emergency Operation Interval
Fault Torelant Time Interval

FTTI

Fault reaction time and fault tolerant time interval (ISO26262-1 Fig.4)
SSS 2016
3/Feb/2016

28

Abstract Functional Safety Mechanism

OutputInput

Controller
Error

SSS 2016
3/Feb/2016

29

Generic initial architecture
w/ safety mechnism• For functional redundancy, we have to several checker/verifier
for the target controller
Refined Controller
OutputaController
Input
Input
Checker

Composeof threecheckblocks

SSS 2016
3/Feb/2016

OutputChecker

Runtime Checker(Fault Detection) （Transit to safe state）

Error30

Initial Architecture
system implementation comp0.i
subcomponents
c : system pcontroller{ISO26262::ASIL => LEVEL_B;};i : system pfsminp.i;s : system pfsmcre.i;o : system pfsmout.i;
connections
c0 : port i.p_out −> s.p_in;
c1 : port s.p_out −> o.p_in;
ce : port o.p_err −> p_err;
annex EMV2 {**use types errorlibrary;use behavior
NILErrorModelLibrary::Basic_behave;…
−− state transition −−
composite error behavior
states[o.failed]−>failed;
end composite;**};
end comp0.i;

SSS 2016
3/Feb/2016

Implementation partISO 26262 property set

Three checkers

in/outUse error annex

Error relating behavior

31

Describing estimated latency
system pfsminpfeatures
p_in : in event data port;
p_out : out event data port;
flows
fll0 : flow path p_in −> p_out{ latency => 1 Ms .. 4 Ms; };Flow	  path

p_in

p_outInput	  Checker	  (pfsminp)

Describe estimated Latency in the flow path

SSS 2016
3/Feb/2016

32

Calculation of FTTI
• To calculate FTTI we need the various flow paths
Refined Controller

OutputaController
Input
Input
Checker

OutputChecker

Runtime	  Checker	  （Fault	  Detection)(Transit	  to	  Safe	  State)

SSS 2016
3/Feb/2016

Error

33

five issues• Item ?
• Item sketch (static & dynamic model)• Safety activity in the whole development process• Use goal model• Finding Hazards• Guide words, Situation-Scenario Matrix (SSM)• How to calculate controllability for ASIL
• Driver model, SSM• Several “times”• AADL and flow modelSSS 2016
3/Feb/2016

34

Conclusion• To support the concept phase of ISO 26262, we propose thepractical approach. This is manly based on the goal model andwe add new features.
– Item Sketch– Scenario-Situation Matrix (SSM)– Driver Model– General functional safety mechanism

SSS 2016
3/Feb/2016

35

Summarize by goal model
Safety Activity(Sub-)Goal

Obstacle

SafetyMechanism

FR: Functional Requirement
FRS: Functional Safety
Requirement
FRFSRDevelopment and Safety Activity by the KAOS Goal modelSSS 2016
3/Feb/201636