Document ID: chunk:federal_register_of_legislation:F2021L01519:reg:60:p13
Version: federal_register_of_legislation:F2021L01519
Segment Type: reg
Provision Reference: reg 60 (pt 13/16)
Character Range: 69189–72304

in "The System" are for example:

                  (a) Fall-back to operation using a partial system.

                  (b) Change-over to a separate back-up system.

                  (c) Removal of the high level function.

               In case of a failure, the driver shall be warned for example by warning signal or message display. When the system is not deactivated by the driver, e.g. by turning the ignition (run) switch to "off", or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.

              3.4.3.1. If the chosen provision selects a partial performance mode of operation under certain fault conditions, then these conditions shall be stated and the resulting limits of effectiveness defined.

              3.4.3.2. If the chosen provision selects a second (back-up) means to realise the vehicle control system objective, the principles of the change-over mechanism, the logic and level of redundancy and any built in back-up checking features shall be explained and the resulting limits of back-up effectiveness defined.

              3.4.3.3. If the chosen provision selects the removal of the Higher Level Function, all the corresponding output control signals associated with this function shall be inhibited, and in such a manner as to limit the transition disturbance.

              3.4.4. The documentation shall be supported, by an analysis which shows, in overall terms, how the system will behave on the occurrence of any individual hazard or fault which will have a bearing on vehicle control performance or safety.

               The chosen analytical approach(es) shall be established and maintained by the Manufacturer and shall be made open for inspection by the Technical Service at the time of the type approval.

              The Technical Service shall perform an assessment of the application of the analytical approach(es). The audit shall include:

                  (a) Inspection of the safety approach at the concept (vehicle) level with confirmation that it includes consideration of interactions with other vehicle systems. This approach shall be based on a Hazard / Risk analysis appropriate to system safety.

                  (b) Inspection of the safety approach at the system level. This approach shall be based on a Failure Mode and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) or any similar process appropriate to system safety.

                  (c) Inspection of the validation plans and results. This validation shall use, for example, Hardware in the Loop (HIL) testing, vehicle on–road operational testing, or any means appropriate for validation.

              The assessment shall consist of checks of hazards and faults chosen by the Technical Service to establish that the manufacturer's explanation of the safety concept is understandable, logical and that the validation plans are suitable and have been completed.

              The Technical Service may perform or may require to perform tests as specified in paragraph