Document ID: chunk:federal_register_of_legislation:F2021C00476:body:0:p59
Version: federal_register_of_legislation:F2021C00476
Segment Type: other
Provision Reference: 
Character Range: 164057–167061

where the latter changes such as to alter the function of the unit as far as this Regulation is concerned, this identification shall also be changed.

         3.4. Safety concept of the manufacturer

         3.4.1. The manufacturer shall provide a statement which affirms that the strategy chosen to achieve "The System" objectives will not, under non-fault conditions, prejudice the safe operation of systems which are subject to the prescriptions of this Regulation.

         3.4.2. In respect of software employed in "The System", the outline architecture shall be explained and the design methods and tools used shall be identified.  The manufacturer shall be prepared, if required, to show some evidence of the means by which they determined the realisation of the system logic, during the design and development process.

         3.4.3. The Manufacturer shall provide the technical authorities with an explanation of the design provisions built into "The System" so as to generate safe operation under fault conditions.  Possible design provisions for failure in "The System" are for example:
          (a) Fall-back to operation using a partial system.
          (b) Change-over to a separate back-up system.
          (c)  Removal of the high level function.

          In case of a failure, the driver shall be warned for example by warning signal or message display.  When the system is not deactivated by the driver, e.g. by turning the Ignition (run) switch to "off", or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.

         3.4.3.1. If the chosen provision selects a partial performance mode of operation under certain fault conditions, then these conditions shall be stated and the resulting limits of effectiveness defined.

         3.4.3.2.  If the chosen provision selects a second (back-up) means to realise the vehicle control system objective, the principles of the change-over mechanism, the logic and level of redundancy and any built in back-up checking features shall be explained and the resulting limits of back-up effectiveness defined.

         3.4.3.3. If the chosen provision selects the removal of the higher level function, all the corresponding output control signals associated with this function shall be inhibited, and in such a manner as to limit the transition disturbance.

         3.4.4. The documentation shall be supported, by an analysis which shows, in overall terms, how the system will behave on the occurrence of any one of those specified faults which will have a bearing on vehicle control performance or safety.

          This may be based on a Failure Mode and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) or any similar process appropriate to system safety considerations.

          The chosen analytical approach(es) shall be established and maintained by the manufacturer and shall be made open for inspection by the