Document ID: chunk:federal_register_of_legislation:F2018C00341:body:0:p53
Version: federal_register_of_legislation:F2018C00341
Segment Type: other
Provision Reference: 
Character Range: 151131–154198

Change-over to a separate back-up system.
          (c)  Removal of the high level function.

          In case of a failure, the driver shall be warned for example by warning signal or message display.  When the system is not deactivated by the driver, e.g. by turning the Ignition (run) switch to "off", or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.

         3.4.3.1. If the chosen provision selects a partial performance mode of operation under certain fault conditions, then these conditions shall be stated and the resulting limits of effectiveness defined.

         3.4.3.2.  If the chosen provision selects a second (back-up) means to realise the vehicle control system objective, the principles of the change-over mechanism, the logic and level of redundancy and any built in back-up checking features shall be explained and the resulting limits of back-up effectiveness defined.

         3.4.3.3. If the chosen provision selects the removal of the higher level function, all the corresponding output control signals associated with this function shall be inhibited, and in such a manner as to limit the transition disturbance.

         3.4.4. The documentation shall be supported, by an analysis which shows, in overall terms, how the system will behave on the occurrence of any one of those specified faults which will have a bearing on vehicle control performance or safety.

          This may be based on a Failure Mode and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) or any similar process appropriate to system safety considerations.

          The chosen analytical approach(es) shall be established and recorded by the manufacturer.

         3.4.4.1. This documentation shall itemise the parameters being monitored and shall set out, for each fault condition of the type defined in paragraph 3.4.4. above, the warning signal to be given to the driver and/or to service/technical inspection personnel.

         4. VERIFICATION AND TEST

         4.1. The functional operation of "The System", as laid out in the documents required in paragraph 3., shall be tested as follows:

         4.1.1. Verification of the function of "The System"

          As the means of establishing the normal operational levels, verification of the performance of the vehicle system under non-fault conditions shall be conducted against the manufacturer's basic benchmark specification unless this is subject to a specified performance test as part of the approval procedure of this or another standard.

         4.1.2. Verification of the safety concept of paragraph 3.4.

          The reaction of "The System" shall, at the discretion of the type approval authority, be checked under the influence of a failure in any individual unit by applying corresponding output signals to electrical units or mechanical elements in order to simulate the effects of internal faults within the unit.

         4.1.2.1.                         The