# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 4 Safety-Oriented System Hardware Architecture Exploration Framework
### FTA-Based Weak-Point Analysis
* Dual-point failure (DPF): MCS contains two hardware elements and id further classified into two kinds of constitution. * MCS consists of the safety-related hardware element and the safety mechanism to protect this safety-related hardware element, represented as {_C(i)_, \(SM_{C(i)}\)}. The failure probability of such an MCS is computed by the following expression \[FP_{MCS}(t)=FP_{RF_{C(i)}}(t)+FP_{DPF,L_{C(i)}}(t)\] (9) where \[FP_{RF_{C(i)}}(t)=1-e^{-\lambda_{C(i)}\times(1-DC_{RF_{C(i)}})\times t}\] (10) and \[FP_{DPF,L_{C(i)}}(t)=1-e^{-(\lambda_{C(i)}\times DC_{RF_{C(i)}}\times(1-DC_{ DPF,L_{C(i)}}))\times t}\] (11) where \(DC_{RF_{C(i)}}\) and \(DC_{DPF,L_{C(i)}}\) represent the diagnostic coverage (DC) of safety mechanisms with regard to the residual faults and latent dual-point faults. Any two safety-related hardware elements could lead to the safety goal violation only when these two hardware elements fail at the same time, represented as {_C(i)_, _C(j)_}. The failure probability of such an MCS is calculated by the following expression  
\[FP_{MCS}(t)=FP_{C(i)}(t)\times FP_{C(j)}(t) \tag{12}\]  
With the above expressions (8)-(12), we can calculate the failure probability for each MCS. An MCS is marked as the safety vulnerability if this MCS's failure probability is greater than or equal to \(PF_{PMHF_{tar}}(t)\), \(PF_{SPFM_{tar}}(t)\), or \(PF_{LFM_{tar}}(t)\). For such an MCS, the safety mechanism must be deployed or upgraded (if existed) to reduce the failure rate of the hardware element(s) in this MCS. Otherwise, the requirements for achieving the target ASIL goal could never be fulfilled. We call such an MCS the MBP (Must-Be-Protected) weak points. There are \(MBP_{PMHF}\), \(MBP_{SPFM}\), and \(MBP_{LFM}\) associated with the safety metrics of PMHF, SPFM, and LFM, respectively. On the contrary, an MCS is termed POD (Protected-On-Demand) if the failure probability is lower than \(PF_{PMHF_{tar}}(t)\), \(PF_{SPFM_{tar}}(t)\), and \(PF_{LFM_{tar}}(t)\). Similarly, an MCS could belong to the \(POD_{PMHF}\), \(POD_{SPFM}\), or \(POD_{LFM}\). It is worth noting that the requirements for reaching the target ASIL may still not be achieved even though all the listed MCS belong to the POD. Under these circumstances, we need to determine the most critical weak point and then deploy or upgrade the safety mechanism to the addressed hardware element so that the most effective failure rate reduction for the whole system can be assured. For each MCS, the quantified gaps between \(FP_{MCS}(t)\) and \(PF_{PMHF_{tar}}(t)\), and \(PF_{SPFM_{tar}}(t)\) and \(PF_{LFM_{tar}}(t)\) are calculated through the following steps:  
1. [label=.] 2. Calculate the \(\lambda_{SPFM_{tar}}\) and \(\lambda_{LFM_{tar}}\): According to expression (5), we know that \(SPFM_{tar}\) can be achieved only when the total failure rates associated with the single-point faults and residual faults are less than \((1-SPFM_{tar})\times\sum_{Safety-Related\ HW\ elements}\lambda\). Thus, the \(\lambda_{SPFM_{tar}}\) can be specified by \[\lambda_{SPFM_{tar}}=(1-SPFM_{tar})\times\sum_{Safety-Related\ HW\ elements}\lambda\] (13) Similarly, according to expression (7), the \(\lambda_{LFM_{tar}}\) can also be specified by \[\lambda_{LFM_{tar}}=(1-LFM_{tar})\times\sum_{Safety-Related\ HW\ elements}(\lambda-\lambda_{SPF}-\lambda_{RF})\] (14)
3. Calculate \(PF_{PMHF_{tar}}(t)\), \(PF_{SPFM_{tar}}(t)\), and \(PF_{LFM_{tar}}(t)\) with the following expressions \[PF_{PMHF_{tar}}(t)=1-e^{-PMHF_{tar}\times t}\] (15) \[PF_{SPFM_{tar}}(t)=1-e^{-\lambda_{SPFM_{tar}}\times t}\] (16) \[PF_{LFM_{tar}}(t)=1-e^{-\lambda_{LFM_{tar}}\times t}\] (17)
4. Calculate \(Gap_{PMHF}(MCS_{k})\), \(Gap_{SPFM}(MCS_{k})\), and \(Gap_{LFM}(MCS_{k})\) for the \(k\)th MCS with the following expressions \[FP_{MCS}(t)=FP_{RF_{C(i)}}(t)+FP_{DPF,L_{C(i)}}(t)\]0 (18) \[FP_{MCS}(t)=FP_{RF_{C(i)}}(t)+FP_{DPF,L_{C(i)}}(t)\]1 (19) \[FP_{MCS}(t)=FP_{RF_{C(i)}}(t)+FP_{DPF,L_{C(i)}}(t)\]2 (20) Subsequently, the \(MCS_{k}\) can be marked as the MBP or POD by the following criteria:
5.