# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 2 Related Works
However, the proposed techniques [14; 15; 16; 17] can only meet the requirement of one single safety-related design metric. Thus, these techniques are not feasible for systems with more than one safety-related design metric to be fulfilled. The core concept of references [18; 19; 20; 21; 22; 23] is very similar. The proposed hardware architecture exploration frameworks in these studies tried to satisfy the system safety requirements in compliance with the target ASIL first and then reduce the hardware overhead through the ASIL decomposition, which is a technique adopted in ISO-26262 for cost-effective considerations. After applying ASIL decomposition, hardware elements or subsystems with a higher ASIL can be decomposed into hardware elements with lower design complexity, and the required ASIL can be lowered accordingly. In such a way, the overall hardware overhead can be effectively reduced. Furthermore, verification and testing efforts can also be reduced due to the lowered ASIL. However, these papers only considered the ideal case, i.e., the ASIL decomposition is feasible. For real automotive systems, ASIL decomposition may not allow the hardware elements to be in hardcore form when they are provided by the suppliers. Thus, the proposed methodology in [18; 19; 20; 21; 22; 23] would be limited to only the systems that the ASIL decomposition allows. To avoid such a limitation, the proposed hardware architecture exploration framework in this study does not adopt ASIL decomposition as the main scheme for hardware overhead reduction. Compared to the previous works, the advantages of the proposed architecture exploration framework in this study primarily concern the following two aspects:  
1. [label=(0)]
2. Complying with more safety-related design metrics. 3. The safety-aware architecture exploration methodologies proposed in the literature tend to only comply with an overall system reliability or PMHF safety metric requirement. However, PMHF is only one of the three safety metrics required in ISO-26262. In fact, two other specific safety-related design metrics, the single-point fault metric (SPFM) and latent-fault metric (LFM), also play important roles in safety-critical design, especially when ISO-26262 is the primary safety norm to be complied with. Thus, we should consider SPFM, LFM, and PMHF metrics holistically. Otherwise, the developed safety-critical system could still contain unknown safety vulnerability, which could lead to reliability and safety problems and violate the requirements of ISO-26262. For example, if multiple-point faults in a system are not considered, then latent faults could exist in such a system. Therefore, specific safety-related design metrics such as SPFM and LFM representing the fault-tolerant capabilities of single-point faults and multiple-point faults are required to be defined and fulfilled. In this study, the proposed safety-orientedsystem architecture exploration framework is highly customized for ISO-26262. We specify the three safety-related design metrics, SPFM, LFM, and PMHF, requested by ISO-26262 as the primary targets to be achieved for safety-critical automotive systems. Thus, the proposed framework can assure that the obtained system architecture can fulfill the safety requirements for single-point and multiple-point fault tolerance as well as overall system reliability and safety. 1. [label=(0)]
2. Satisfying safety-related design metrics and hardware overhead constraints simultaneously in a very limited number of design iterations. In addition to the safety-related design metrics required by ISO-26262, the proposed system architecture exploration framework also takes hardware overhead into account. Thus, there are four design metrics to be satisfied so that the high-design-complexity problem, as encountered in previous works [13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23], arises to be resolved.