Document ID: chunk:federal_register_of_legislation:F2018C00341:body:0:p52
Version: federal_register_of_legislation:F2018C00341
Segment Type: other
Provision Reference: 
Character Range: 148281–151384

the units

          The function of each unit of "The System" shall be outlined and the signals linking it with other Units or with other vehicle systems shall be shown.  This may be provided by a labelled block diagram or other schematic, or by a description aided by such a diagram.

         3.3.3. Interconnections

          Interconnections within "The System" shall be shown by a circuit diagram for the electrical transmission links, by an optical-fiber diagram for optical links, by a piping diagram for pneumatic or hydraulic transmission equipment and by a simplified diagrammatic layout for mechanical linkages.

         3.3.4. Signal flow and priorities

          There shall be a clear correspondence between these transmission links and the signals carried between units.

          Priorities of signals on multiplexed data paths shall be stated, wherever priority may be an issue affecting performance or safety as far as this standard is concerned.

         3.3.5. Identification of units

          Each unit shall be clearly and unambiguously identifiable (e.g. by marking for hardware and marking or software output for software content) to provide corresponding hardware and documentation association.

          Where functions are combined within a single unit or indeed within a single computer, but shown in multiple blocks in the block diagram for clarity and ease of explanation, only a single hardware identification marking shall be used.

          The manufacturer shall, by the use of this identification, affirm that the equipment supplied conforms to the corresponding document.

         3.3.5.1. The identification defines the hardware and software version and, where the latter changes such as to alter the function of the unit as far as this Regulation is concerned, this identification shall also be changed.

         3.4. Safety concept of the manufacturer

         3.4.1. The manufacturer shall provide a statement which affirms that the strategy chosen to achieve "The System" objectives will not, under non-fault conditions, prejudice the safe operation of systems which are subject to the prescriptions of this Regulation.

         3.4.2. In respect of software employed in "The System", the outline architecture shall be explained and the design methods and tools used shall be identified.  The manufacturer shall be prepared, if required, to show some evidence of the means by which they determined the realisation of the system logic, during the design and development process.

         3.4.3. The manufacturer shall provide an explanation of the design provisions built into "The System" so as to generate safe operation under fault conditions.  Possible design provisions for failure in "The System" are for example:
          (a) Fall-back to operation using a partial system.
          (b) Change-over to a separate back-up system.
          (c)  Removal of the high level function.

          In case of a failure, the driver shall be warned for example by warning signal or message display.  When the system is not deactivated by the driver,