# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 4 Safety-Oriented System Hardware Architecture Exploration Framework
### System Hardware Architecture Exploration with Safety and Hardware Overhead Consideration
#### 4.3.2. ASIL-Oriented Hardware Architecture Exploration Algorithm  
In Section 4.2, we have pointed out that \(Gap_{PMHF}\)(\(MCS_{k}\)), \(Gap_{SPFM}\)(\(MCS_{k}\)), and \(Gap_{LFM}\)(\(MCS_{k}\)) must all be lower than 1 to eliminate the gaps between current and target failure probabilities so that the three hardware architecture metrics could be achieved. As seen from Figure 3, \(Max\_Gap(k)\) represents the maximum gap among \(Gap_{PMHF}\)(\(MCS_{k}\)), \(Gap_{SPFM}\)(\(MCS_{k}\)), and \(Gap_{LFM}\)(\(MCS_{k}\)) for the \(MCS_{k}\). In the following, we assume \(MCS_{k}\) contains the hardware element _C(i)_. Therefore, the reduced failure probabilities obtained from the safety mechanism deployment shall comply with the following condition:  
\[\frac{FP_{MCS_{k}}(t)}{FP_{RF_{MCS_{k}}}(t)}>Max\_Gap(k) \tag{21}\]  
where \(FP_{MCS_{k}}(t)\) is the original failure probability of \(MCS_{k}\) attributed to the hardware element _C(i)_'s failures without any safety mechanism protection, and \(FP_{RF_{MCS_{k}}}(t)\) is the failure probability due to residual faults attributed to the hardware element _C(i)_ under the safety mechanism protection. Then, the \(DC_{RF_{MCS_{k}}}\) can be obtained according to the linearity between the \(FP_{MCS_{k}}(t)\), \(FP_{RF_{MCS_{k}}}(t)\) and \(Max\_Gap(k)\) as described below. * If \(Max\_Gap(k)\) = 2, the expression (21) can be rewritten as \(FP_{RF_{MCS_{k}}}(t)<0.4\times FP_{MCS_{k}}(t)\). Next, we let \(FP_{MCS_{k}}(t)=FP_{C(i)}(t)\) and \(FP_{RF_{C(i)}}(t)=1-e^{-\lambda_{C(i)}\times(1-DC_{RF_{C(i)}})\times t}\cong \left(1-DC_{RF_{C(i)}}\right)\times FP_{C(i)}(t)\). Thus, we can acquire the expression \(\left(1-DC_{RF_{C(i)}}\right)\times FP_{C(i)}(t)<0.4\times FP_{C(i)}(t)\), which means that the \(DC_{RF_{C(i)}}\) must be greater than 60%. Therefore, we can conclude that the \"Low\" safety mechanism is sufficient to eliminate the gaps if \(Max\_Gap(k)<2.5\). * Similarly, if \(2.5\leq Max\_Gap(k)<10\), then we can induce the \(DC_{RF_{C(i)}}\) = 90%, i.e., \"Medium\" safety mechanism to be sufficient and \(DC_{RF_{C(i)}}\) = 99%, i.e., \"High\" safety mechanism deployment for the case \(Max\_Gap(k)\geq 10\). Once the \(DC_{RF_{C(i)}}\) is decided, the \(FP_{DPF,L_{C(i)}}(t)\) becomes nonzero. Therefore, the current \(FP_{MCS_{k}}(t)\) can be expressed as \(FP_{RF_{C(i)}}(t)+FP_{DPF,L_{C(i)}}\) and all the \(Gap_{PMHF}\)(\(MCS_{k}\)), \(Gap_{SPFM}\)(\(MCS_{k}\)) and \(Gap_{LFM}\)(\(MCS_{k}\)) need to be updated to reflect such changes. The updated \(Gap_{PMHF}\)(\(MCS_{k}\)), \(Gap_{SPFM}\)(\(MCS_{k}\)), and \(Gap_{LFM}\)(\(MCS_{k}\)) here are used to determine the \(DC_{DPF,L_{C(i)}}\). Accordingly, \(FP_{RF_{C(i)}}(t)\) should be excluded when updating the gaps so that the \(DC_{DPF,L_{C(i)}}\) assignment can assure that the derived \(FP_{MCS_{k}}(t)\) can be lower than  
```
15: {if (\(DC_{DPFL_{LP(t)}}\
eq 99\%\) and \(DC_{DPFL_{LP(t)}}\leq DC_{RF_{TP(t)}}\)) then upgrade \(DC_{DPFL_{LP(t)}}\) to the next higher level of DC; SM-status \(\leftarrow\) 'true'; //as mentioned before, the protection of hardware element for single-point and dual-point faults is based on the concept of safety mechanism with self-checking. Therefore, considering the effectiveness of failure rate reduction and the increased hardware overhead, when DC of latent dual-point faults is not at the highest level and less than or equal to the DC of single-point faults, the \(DC_{DPFL_{LP(t)}}\) is upgraded to the next higher level of DC/ //
16:if (SM-status = 'false' and \(DC_{RF_{TP(t)}}\
eq 99\%\)) then upgrade \(DC_{RF_{TP(t)}}\) to the



means that the \(DC_{RF_{PT(c)}}\) = 90% with \"Medium\" hardware overhead and \(DC_{DPF,L_{PT(c)}}\) is still unspecified. The meaning of SM\({}_{\text{HVH}}\) can be explained in a similar way. After safety mechanism deployment to avoid single-point faults, the \(Gap_{SM,D}\) for C(3) and C(4) need to be updated following the aforementioned process with expressions (22)-(24).