# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 3 ISO-2626 Hardware Architecture Metrics  
Failure mode, effect, and diagnostic analysis (FMEDA) is a systematic analysis technique to obtain subsystem/product level failure rates, failure modes, and diagnostic capability. The main purpose of FMEDA in ISO-26262 is to evaluate hardware architecture metrics and safety goal violations due to random hardware failures and provide sufficient information to improve safety gaps if the required hardware safety level is not fulfilled. The hardware architecture metrics include the single-point fault metric (SPFM), latent-fault metric (LFM), and probabilistic metric for hardware failure (PMHF). SPFM reflects the robustness of the item to single-point and residual faults by either coverage from safety mechanisms or design (primarily safe faults). A high SPFM implies that the proportion of single-point faults and residual faults in the hardware of the item is low. LFM reflects the robustness of the item to latent faults by either coverage of faults in safety mechanisms or by the driver recognizing that the fault exists before the violation of the safety goal, or by design (primarily safe faults). A high latent-fault metric implies that the proportion of latent faults in the hardware is low. Finally, PMHF is a probabilistic metric for evaluating the violation of the considered safety goal due to random hardware failure. Table 1 lists the target values for SPFM, LFM, and PMHF under different ASILs. It is worth noting that there is no target value for ASIL A. To acquire PMHF, SPFM, and LFM, \(\lambda_{S}\), \(\lambda_{SPF}\), \(\lambda_{RF}\), and \(\lambda_{DPFL}\), which represent the failure rates associated with a safe fault, single-point fault (SPF), residual fault (RF), and latent dual-point fault (DPF), have to be derived in advance. Figure 1 shows the failure rate calculation process according to ISO-26262, where \(\lambda_{C(i)}\) is the failure rate of the \(i\)th safety-related component _C(i)_ and assumes the system has \(n\) number of safety-related elements. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **ASIL B** & **ASIL C** & **ASIL D** \\ \hline SPFM & \(\geq\)90\% & \(\geq\)97\% & \(\geq\)99\% \\ LFM & \(\geq\)60\% & \(\geq\)80\% & \(\geq\)90\% \\ PMHF & \(<\)10\({}^{-7}\) h\({}^{-1}\) & \(<\)10\({}^{-7}\) h\({}^{-1}\) & \(<\)10\({}^{-8}\) h\({}^{-1}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Target values of SPFM, LFM, and PMHF for different ASILs. For a safety-related hardware element, _C(i)_, its faults consist of safe and non-safe faults. The safe faults will not cause a safety goal violation. Therefore, only the non-safe faults could cause a safety goal violation and contribute to the \(\lambda_{SPF}\) if there is no safety mechanism to protect the faults. If there is a safety mechanism to prevent the faults of _C(i)_ from causing a safety goal violation, then the faults not covered by the safety mechanism are identified as residual faults of _C(i)_, and the corresponding failure rate, \(\lambda_{RF}\), can be derived from the following expression (1)  
\[\lambda_{RF}=\lambda_{\text{C(i)}}\times(percentage\ of\ non-safe\ faults)\times \left(1-DC_{RF_{C(i)}}\right) \tag{1}\]  
where \(\lambda_{\text{C(i)}}\) and \(DC_{RF_{C(i)}}\) are the failure rate and the diagnostic coverage with respect to the residual faults of _C(i)_. In Figure 1, the faults of _C(i)_ that have no potential to directly cause the system to violate the safety goals are identified as multiple-point faults. There are two sources of the multiple-point faults; the first one is attributed to the single-point faults covered by the safety mechanism, and the second one is from faults that can cause the system to violate the safety goals only when the fault in _C(i)_ combines with one or more other independent faults. Because the probability of violation of the safety goal contributed to by three or more faults is low enough, we treat them as safe faults in this study.