# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 4 Safety-Oriented System Hardware Architecture Exploration Framework
### System Hardware Architecture Exploration with Safety and Hardware Overhead Consideration
#### 4.3.2. ASIL-Oriented Hardware Architecture Exploration Algorithm
Figure 8 illustrates the fault tree constructed from the hardware architecture as shown in \[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]2 The K-out-of-N (or K/N) gate reflects the fail-operational design concept 3/4 (3-out-of-4) gate for four EBD nodes. It means that the failure of one EBD node will not lead to the AEB system failure. \[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]3 Constructed fault tree of the illustrated AEB system. \[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]4 Hardware architecture of the AEB system. One thing should be pointed out, and that is the concept of safety mechanism library presented in Section 4.3.1 is developed only for demonstrating the idea of the proposed safety framework. However, the variety of safety mechanisms or fault-tolerant techniques in the real world is more diverse than the safety mechanisms defined in Section 4.3.1. Therefore, in addition to the safety mechanisms described in Section 4.3.1, we also employ other types of safety mechanisms in the case study to concretely demonstrate our safety framework with more diverse safety mechanisms in the design of safety-critical automotive systems. There are two kinds of safety mechanisms used in the case study, which do not belong to the safety mechanism library depicted in Section 4.3.1. The first one is the aforementioned k-out-of-n design applied at the system level instead of the element level for the EBD nodes. The advantage of implementing the element protection at the system level is that the additional safety mechanism for each individual hardware element is not required but needs to develop the error detection scheme to monitor the healthy status of EBD nodes. Here, we assume that an error detection has been embedded in each of the EBD nodes. Moreover, the corresponding design and verification complexity are raised as well. Besides, an issue arises regarding such a design, and that is how one can evaluate the failure rates for the hardware elements, i.e., Brake ECUs and EBM in this case study, under the protection of the K/N fault-tolerant design. In fact, the failure rates of each individual hardware element cannot be evaluated through the proposed expressions (1) and (2) because the effectiveness of the K/N fault-tolerant design cannot be directly represented by the diagnostic coverage \(DC_{RF_{T(t)}}\) and \(DC_{PDF,L_{PT(t)}}\). Instead, only an overall failure rate for the whole K/N-formed subsystem constituted by the four EBD nodes can be evaluated. The detailed steps for the evaluation are illustrated as follows. 1. Let \(\lambda_{B\_ECU}\), \(\lambda_{EBM}\), and \(\lambda_{EBD}\) be the failure rates of the Brake ECU, EBM, and EBD nodes (which represents any one of EBD nodes 1-4) and then \(\lambda_{EBD}=\lambda_{B\_ECU}+\lambda_{EBM}\) because either the failed Brake ECU or failed EBM would lead to the failure of the EBD node. 2. Let \(R_{K/N}(t)\) be the reliability of the K/N-formed subsystem estimated at mission time \(t\) and then the \(R_{K/N}(t)\) can be computed through expression (27) as shown below [29; 30]. \[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]5 (27)
3. Let \(\lambda_{K/N\_Sub}\) be the failure rate of the K/N-formed subsystem and then the \(\lambda_{K/N\_Sub}\) can be acquired by the following expression (28). \[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]6 (28)

The second type of safety mechanism is the hardware duplication.