## Case Study
### Applying Stpafet
#### 5.2.4 Causal Factors Identification and FSRs Creation  
* In order to determine how each UCA could happen using FMES, a detailed structure of the FLEDS is illustrated in Figure 8. We use Figure 8 and the guide words for causal factors in Figure 9 [39] to identify possible causal factors leading to UCAs. With the focus of FMEA on the lowest level components, we can identify the causal factors more systematically, so more detailed safety constraints could be derived, which is conducive to the refinement of FSR. * We use a hierarchical structure to describe the identified causal factors for each UCA in Table 6, in which \"()\" represents the highest level and \"()\" represents the lowest. This hierarchical structure presents how unsafe interactions, errors and failures propagate through the system and lead to UCAs. The most important thing is that the hierarchical structure of causal factors would be of great benefit for the allocation of FSRs to the system architecture design. * Next, the SCs for causal factors are generated and the results of this step will be used to build the functional safety concept and determine the FSRs. The primary intention of the presentation of all the SGs and FSRs derived from SCs in this section are to illustrate how a comprehensive set of requirements could be derived from STPAFT analysis results. According to the causal factors identified in Table 6, related SCs could be identified:  
* SC_CF.1: The input signals for estimating the total fuel level shall be good status (meaning the signals are in the range and correct). * SC_CF.1-1: The FLS shall always keep running normally, and measure fuel level data accurately. * SC_CF.1-2: The EMS shall always calculate the fuel rate correct. * SC_CF.2: The input parameters used for estimation of the total fuel level shall be of good status; a replacement value shall be considered and kept. * SC_CF.2-1: The correct parameters of FLS shall be set. * SC_CF.2-2: The correct parameters of the fuel tank shall be set. * SC.CF3: The measured fuel level signal shall be filtered to avoid the fuel level changing rapidly in some situations, such as driving in long curves, hills and slopes. * SC.CF4: The algorithm for total fuel level estimation shall be designed appropriately and a feedback should be set to avoid the deviation of more or less than a permissible error when there are erroneous or unavailable input signals or parameters. * SC.CF4-1: The mapping of voltage to volume shall be correct. * SC.CF5: When the estimated fuel level reaches a limit of the measurable volume in the tank, the low fuel level warning shall be provided one time. * SC.CF6: The ICL shall always function properly, including the gauge and the lamp. * SC.CF7: Stability and reliability of Controller Area Network (CAN) buses and communication cables shall be guaranteed through certain approaches, such as redundancies of the CAN buses and communication cables. * SC.CF8: The battery shall have enough capacity and ensure power supply continuous and reliable. The electrical connections between the battery and ECUs shall be stable. Then, the corresponding FSRs could be derived from these SCs according to the requirements that FSR shall specify strategies for fault avoidance, fault detection and control of faults or the resulting of malfunctioning behaviors, etc. in ISO26262 Part 3. * FSR1: The input signals for estimating the total fuel level shall be good status (meaning the signals are in the range and correct). Considered input signals are: fuel level, fuel rate, and parking brake applied. In case input signals are not of good status, a replacement value shall be considered. * FSR2: The input parameters used for estimation of the total fuel level shall be of good status; a replacement value shall be considered and kept. Considered input parameters are sensor parameters and tank parameters. * FSR3: The measured fuel level signal shall be filtered to avoid rapid fuel level changes in some situations, such as driving in long curves, hills and slopes.