Dependent Failure Analysis (DFA)
Learn to test the independence and freedom-from-interference claims your safety concept rests on, using the ISO 26262-9 method at system, hardware and software level.
- Chapters
- 11
- Chapters
- Method steps
- 6
- Method steps
- Worked examples
- 2
- Worked examples
Quick answers
- What is dependent failure analysis (DFA) in ISO 26262?
- Dependent failure analysis is the method defined in ISO 26262-9, Clause 7 for verifying that elements which are claimed to be independent, or merely free from interference, really are. Statistical independence is an assumption, not a physical guarantee: a shared supply, clock, memory, or environment can let a single root cause defeat several elements at once. DFA systematically identifies dependent failure initiators (DFIs) and the coupling factors connecting supposedly independent elements, then confirms that mitigations break the coupling. It underpins ASIL decomposition, redundancy claims, and mixed-ASIL coexistence, and it runs iteratively from the concept phase through hardware and software design.
- What is the difference between common-cause and cascading failures?
- A common-cause failure strikes multiple elements from one shared root: for example, a shared 5 V reference drifting and corrupting both channels of a redundant sensor pair at the same time. A cascading failure propagates from one element to the next: the first element fails, and its failure causes the second to fail. Both are dependent failures, and both defeat independence claims, but they need different mitigations: a common cause is broken by removing the shared resource or adding diversity, while a cascade is broken by blocking the propagation path.
Why it pays for itself
Prove independence instead of assuming it
Redundancy and ASIL decomposition claims collapse when one root cause defeats both channels. The six-step DFA method turns those assumptions into a validated independence argument backed by evidence.
Hunt initiators with a checklist
A category-by-category coupling-factor checklist (proximity, shared power and ground, shared memory and communication, common IP and tooling) drives complete coverage so no plausible dependent failure initiator slips through.
Work it at every level
Two worked examples, a dual-ECU steering topology at system level and a fictional dual-channel brake control, take independence claims through candidate scenarios to measures with effectiveness evidence.
What you’ll be able to do
Validate independence claims
Decide whether decomposition and redundancy claims hold by checking that no single root cause bridges the channels.
Identify dependent failure initiators
Surface the root-cause events and coupling factors that link elements you assumed were independent.
Run the method at every level
Apply the structured DFA from system topology down to hardware and software, with clean hand-offs between them.
Select effective mitigations
Choose separation, diversity, partitioning and monitoring measures that actually break the coupling you found.
Separate DFA, FFI and CCF
Use each term correctly and connect them into one coherent independence argument.
Chapter by chapter
- 01
Why DFA Matters
See why an independence claim is a hypothesis to test, the reasons DFA is performed, and where the method lives in ISO 26262-9.
- Independence claims
- Reasons to perform DFA
- Normative home in Part 9
- 02
Common-Cause vs Cascading
Separate the two dependent-failure patterns in plain language, compare them side by side and place both under their parent category.
- Plain-language definitions
- Side-by-side comparison
- Automotive examples
- 03
Coupling Factors & DFI
Learn what a dependent failure initiator is, how coupling factors give it a path, and how the depth of the analysis should scale.
- Dependent failure initiators
- Coupling factor categories
- Pathway model
- 04
DFA in the Lifecycle
Place DFA on the V-model and list the inputs it consumes and the outputs it hands to later work products.
- V-model placement
- Required inputs
- Produced outputs
- 05
The DFA Method
Walk the six-step process from scoping the independence claim to recording the evidence, and set up the worksheet that carries it.
- Method overview
- Six-step process
- Worksheet structure
- 06
Coupling-Factor Checklist
Use a structured checklist that regroups the coupling-factor classes into working categories, so every path in the scoped architecture gets a recorded answer.
- Using the checklist
- Working categories
- Recorded rationale
- 07
DFA at System Level
Run the analysis on the vehicle topology, hand findings down to the hardware and software DFAs, and decide when the system DFA is done.
- System-level coupling factors
- Hardware and software hand-off
- Dual-ECU steering example
- 08
DFA for Hardware
Examine hardware coupling categories, study the common-cause concerns of a dual-core lockstep, and rank the available mitigations.
- Hardware coupling categories
- Lockstep case study
- Mitigation hierarchy
- 09
DFA for Software
Find software coupling factors, apply the three interference dimensions, and show freedom from interference between sub-elements on a partitioned OS.
- Software coupling factors
- Three FFI dimensions
- Protected OS partitioning
- 10
Worked Example
Apply the method to a fictional dual-channel brake control: set scope and assumptions, list candidate scenarios, and attach measures with effectiveness evidence.
- Scope and assumptions
- Candidate scenarios
- Effectiveness evidence
- 11
DFA vs FFI vs CCF
Pin down DFA, freedom from interference, common-cause and cascading failure so the terms stay consistent across your safety documentation.
- Precise definitions
- Master comparison
- How the concepts fit
Read all 11 chapters with Expert.
Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide.
Expert plan pricingNot just text: the visual toolkit
Common-cause vs cascading timeline
One shared root striking two elements at once, set against a failure that travels from one element to the next.
Coupling path breaker
Follow an initiator along its coupling path and see which measure interrupts it.
Coupling-factor coverage heat map
Shows at a glance which coupling categories an analysis has examined and which it has not.
Redundancy, diversity and independence
A comparator that separates three properties engineers often treat as one.
Dual-ECU steering topology
System-level coupling paths drawn on a redundant steering architecture.
Fictional Dual-Channel Brake Control
Chapter 10 applies the full method to two brake control channels, from the independence claim under test to the evidence that each measure works.
- Scope, assumptions and the independence claim being tested
- A coupling map of the two control channels
- Candidate dependent-failure scenarios across shared resources
- Measures assigned to each scenario and the evidence of their effectiveness
Unlock in course
Who this guide is for
- Engineers relying on ASIL decomposition who must defend the independence requirement
- Hardware designers with lockstep cores or redundant sensor channels
- Software architects hosting mixed-ASIL components on one microcontroller
- Reviewers and assessors checking whether an independence argument actually holds
Frequently Asked Questions
Common questions about Dependent Failure Analysis (DFA)
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov and RBD simulators, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required.
Continue with
Where this topic leads next.
- Safety analysesHAZOP (Hazard and Operability Study) in ISO 26262Learn to think in deviations, not just failures, using guide words applied to a system's design intention to surface hazards a checklist would miss. See how a technique born in the process industry becomes a rigorous, worksheet-driven feeding source for the ISO 26262 HARA.
- Safety analysesMarkov Chains AnalysisLearn state-transition modeling for multi-state systems with degradation, repair, and fault tolerance scenarios. Includes an interactive Markov calculator, a dual-channel model explorer, and comparison with FTA and FMEA.
- Verification and assessmentVerification & ValidationLearn multi-level verification from unit testing through system and vehicle validation with ASIL-dependent coverage criteria. Covers reviews, HIL/SIL testing, fault injection, MC/DC coverage, and evidence management.