# Safety-Oriented System Hardware Architecture Exploration in Compliance with ISO 26262
## 4 Safety-Oriented System Hardware Architecture Exploration Framework
### System Hardware Architecture Exploration with Safety and Hardware Overhead Consideration
#### 4.3.2. ASIL-Oriented Hardware Architecture Exploration Algorithm
\[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.64+1.44+2}{6+4+8+10+3}=\frac{4.56}{31}=14. 71\%\]

\[SPFM_{ite\_d}=1-\frac{\sum_{\textit{Safety-Related HW elements}}(\lambda_{SPF}+ \lambda_{RF})}{\sum_{\textit{Safety-Related HW elements}}\lambda}=1-\frac{7.13 \times 10^{-8}}{1.43\times 10^{-6}}=95.01\%\]

\[LFM_{ite\_d}=1-\frac{\sum_{\textit{Safety-Related HW elements}}(\lambda_{MPF,L})}{\sum_{\textit{Safety-Related HW elements}}(\lambda-\lambda_{SPF}-\lambda_{RF})}=1-\frac{2.13\times 10^{-8}}{1.36 \times 10^{-6}}=98.44\%\]

\[PMH\textit{File\_d}=\lambda_{SPF}+\lambda_{RF}+\lambda_{MPF,L}=9.26\times 10^{-8}\]

The results show that all the hardware architecture metrics and the hardware overhead constraint have been satisfied. Thus, the fault tree can be updated with the results of the safety mechanism deployment as exhibited in Figure 5.

With this simple example, we have demonstrated that the proposed safety-oriented system hardware architecture exploration framework can simultaneously deal with four design metrics (three safety metrics and one hardware overhead constraint) with two exploration algorithms. The framework can deliver a system hardware architecture that conforms to the safety and hardware overhead requirements in a very limited number of design iterations. In the following section, to concretely demonstrate the effectiveness of the proposed framework, we employ a safety-critical AEB (Autonomous Emergency Braking) system adopted in the real automotive industry to exemplify how to apply the proposed framework to such a safety-related system design. ## 5 Case Study--An Autonomous Emergency Braking System

Figure 6 shows the functional block diagram of the AEB system [4]. The primary function of the AEB system is to warn drivers about emergent situations and autonomously brake vehicles to avoid a serious collision if drivers do not react to the warning signal. For implementing the warning and autonomous braking function, radar will continuously monitor the distance between the subject vehicle and the front vehicle and provide the distance information to the central AEB control node. Once the AEB control node is aware that the current distance falls into the dangerous range and a collision could happen under the relative vehicle speed, the AEB control node will first send a warning message (a sound or flashlight) to warn the driver. If the driver does not react to the warning message and the situation becomes more severe, the AEB control node will inform the electric braking units to immediately perform the braking action to avoid the serious collision. Figure 7 shows the hardware architecture of the AEB system. The CAN bus is adopted as an in-vehicle communication backbone. According to the designer's requirements, other

\[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]0 Updated fault tree for the simple system with final safety mechanism deployment. \[HO\_Total_{ite\_d}(\%)=\frac{\sum_{t=1}^{4}HC\big{(}SM_{xyz}(PT\_d(e))\big{)} }{\sum_{i=1}^{5}HC(i)}=\frac{0.48+0.32+1.44+2}{6+4+8+10+3}=\frac{4.36}{31}= 13.68\%\]1 Functional block diagram of AEB system. advanced in-vehicle communication protocols such as FlexRay or automotive Ethernet can also be employed. The braking function of the AEB system is implemented with fail-operational consideration. Once any one among four EBD nodes (whether the Brake ECU or the EBM, Electric Brake Module) is diagnosed as having failed, the AEB control node will stop sending the braking force to the failed EBD node. Under the circumstances, braking forces are redistributed to the remaining three working EBD nodes. Therefore, the AEB system can tolerate one failed EBD node with degraded braking performance.