# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 4 Safety-Oriented System Hardware Architecture Exploration Framework
### FTA-Based Weak-Point Analysis  
After \(PMHF_{ite\_d}\), \(SPFM_{ite\_d}\), and \(LFM_{ite\_d}\), are acquired, we can compare them with the target values to check whether the functional safety requirements can be fulfilled. When any requirement is violated, the current system hardware architecture should be analyzed to identify the main contributors to the safety goal violation. We term such an analysis as the weak-point analysis. The weak-point analysis should provide the precise basis to guide the deployment of a feasible safety mechanism for the vulnerable components so that all target values of the hardware architecture metrics can be achieved in an efficient and cost-effective manner. In this study, we propose an effective weak-point analysis methodology based on fault tree analysis (FTA). FTA has been widely adopted as the primary system-level reliability modeling for decades. Besides, in ISO-26262, FTA is also recommended as the primary system-level safety analysis methodology. However, the concrete measures are not disclosed. To address this hiatus, we intend to illustrate how to locate the safety vulnerability in the system through the FTA approach. Before explaining the proposed FTA measures, the following notations need to be defined in advance:  
* \(FP_{\text{MCS}}(t)\): The failure probability for an MCS at mission time \(t\);
* \(FP_{RF_{C(i)}}(t)\): The failure probability associated with the residual faults for a hardware element _C(i)_ at mission time \(t\);\(FP_{DPF,L_{C(i)}}(t)\): The failure probability associated with the latent dual-point faults for a hardware element _C(i)_ at mission time \(t\);
* \(\lambda_{SPFM_{tar}}\): The target failure rate to be achieved for satisfying the SPFM requirement with respect to the target ASIL;
* \(\lambda_{LFM_{tar}}\): The target failure rate to be achieved for satisfying the LFM requirement with respect to the target ASIL;
* \(PF_{PMHF_{tar}}(t)\): The target failure probability at mission time \(t\) to be achieved for satisfying the PMHF requirement with respect to the target ASIL;
* \(PF_{SPFM_{tar}}(t)\): The target failure probability at mission time \(t\) to be achieved for satisfying the SPFM requirement with respect to the target ASIL;
* \(PF_{LFM_{tar}}(t)\): The target failure probability at mission time \(t\) to be achieved for satisfying the LFM requirement with respect to the target ASIL;
* \(Gap_{PMHF}(MCS_{k})\): The quantified gap between the failure probability for the \(k\)th MCS in the system hardware and the \(PF_{PMHF_{tar}}(t)\) at mission time \(t\);
* \(Gap_{SPFM}(MCS_{k})\): The quantified gap between the failure probability for the \(k\)th MCS in the system hardware and the \(PF_{SPFM_{tar}}(t)\) at mission time \(t\);
* \(Gap_{LFM}(MCS_{k})\): The quantified gap between the failure probability for the \(k\)th MCS in the system hardware and the \(PF_{LPM_{tar}}(t)\) at mission time \(t\). First, we take the system to be analyzed as the input and construct the corresponding fault tree according to the system hardware architecture. The process of constructing a fault tree is out of this paper's scope but has been comprehensively illustrated in previous literature [5; 6; 7; 8; 9; 10; 11; 24; 25; 26; 27; 28] either from the system preliminary hardware architecture or from the system-level simulation models. Thus, the details of fault tree construction are omitted in this study. After the fault tree is constructed, the FTA can be performed to list all the MCSs for the fault tree. Next, we classify all the listed MCSs into the following two types:  
* Single-point failure (SPF): MCS contains a single safety-related hardware element represented as {_C(i)_}. * The failure probability of the MCS belonging to SPF is calculated by the following expression \[FP_{MCS}(t)=FP_{C(i)}(t)=1-e^{-\lambda_{C(i)}\times t}\] (8) where \(FP_{C(i)}(t)\) is the failure probability of the safety-related hardware element _C(i)_ at mission time \(t\).