# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 4 Safety-Oriented System Hardware Architecture Exploration Framework
### FTA-Based Weak-Point Analysis
When \(Gap_{PMHF}(MCS_{k})\), \(Gap_{SPFM}(MCS_{k})\), or \(Gap_{LFM}(MCS_{k})\) \(\\(<\)1 \(\rightarrow\) for \(Gap_{x}(MCS_{k})<\) 1, \(MCS_{k}\) is identified as a \(POD_{x}\) weak point for the corresponding safety metric \(x\), where \(x\) can be \(PMHF\), \(SPFM\), or \(LFM\). The process regarding the FTA-based weak-point analysis is exhibited in \[FP_{MCS}(t)=FP_{RF_{C(i)}}(t)+FP_{DPF,L_{C(i)}}(t)\]3 All the hardware elements in the MBP weak points are required to lower their failure rates by safety mechanism deployment until there are no hardware elements marked as MBP weak points. Therefore, we specify a set named \(PT\_MBP\), which is the union of \(MBP_{PMHF}\), \(MBP_{SPFM}\), and \(MBP_{LFM}\) to contain all the MBP weak points. If \(PT\_MBP\) is not an empty set, then all the hardware elements in \(PT\_MBP\) are required to employ the appropriate safety mechanisms to diminish the failure rates. On the other hand, if the \(PT\_MBP\) becomes an empty set, then all the MCSs belong to the POD. If the target ASIL is still not achieved, the MCS with the highest \(Gap_{x}(MCS_{k})\), where \(x\) can be \(PMHF\), \(SPFM\), or \(LFM\), is selected, and the hardware elements contained in this MCS are assigned to set \(PT\) for \(POD\). The elements in set \(PT\) for \(POD\) are the targets to conduct the safety mechanism deployment or enhancement. For safety mechanism deployment or improvement, we develop an ASIL-oriented system hardware architecture exploration algorithm to effectively apply safety mechanisms to achieve the safety requirements for the target ASIL goal. This algorithm will be introduced in the next subsection. Before we depict the FTA-based weak-point analysis methodology, a simple example is used to explain the idea of the methodology. In this example, we assume that there are five hardware elements in the system. Furthermore, all five hardware elements are not protected by any safety mechanism initially. Table 2 shows the original failure rates for these five elements and Figure 4 shows the constructed fault tree for this simple system. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**HW Element** & **HW Unit * & **\% Non-Safe Fault** & **Failure Rate \(\lambda_{C\bar{Q}}\)(/h)** \\ \hline C_(1)_ & 6 & 100\% & 7.6 \(\times\) 10\({}^{-8}\) \\ C_(2)_ & 4 & 100\% & 4.4 \(\times\) 10\({}^{-8}\) \\ C_(3)_ & 8 & 100\% & 2.6 \(\times\) 10\({}^{-7}\) \\ C_(4)_ & 10 & 100\% & 1.05 \(\times\) 10\({}^{-6}\) \\ C_(5)_ & 3 & 0\% & 1.2 \(\times\) 10\({}^{-8}\) \\ \hline \hline \end{tabular}  
* 1 HW unit = 10 K gate counts.  
\end{table} 
Table 2: The hardware elements and their failure rates. Figure 3: Execution flow of the proposed FTA-based weak-point analysis. We point out that the hardware element _C(5)_ does not appear in the constructed fault tree in Figure 4 because all of _C(5)_'s faults have no chance of causing a safety goal violation as shown in Table 2. In this example, we assume that the target ASIL is B. Therefore, the \(SPFM_{tar}=90\%\), \(LFM_{tar}=60\%\), and \(PMHF_{tar}=10^{-7}\) h\({}^{-1}\) according to Table 1.  
First, the failure rates as seen below are computed following the process of Figure 1.  
\[\sum_{Safety-Related\ HW\ elements}\lambda_{s}=1.2\times 10^{-8}\]  
\[\sum_{Safety-Related\ HW\ elements}\lambda_{SPF}=\lambda_{C(1)}+\lambda_{C(2 )}+\lambda_{C(3)}+\lambda_{C(4)}=1.43\times 10^{-6}\]  
\(\sum_{Safety-Related\ HW\ elements}\lambda_{RF}=\sum_{Safety\ Related\ HW\ elements}\lambda_{DPF,L}=0\) (no hardware elements are applied to the safety mechanism). Then the target failure probabilities at a mission time o five thousand hours can be calculated according to expressions (13)-(17) as shown below.