Proven in Use
10 chapters Most reuse decisions turn on one question: can field experience stand in for development rigour? This concept walks ISO 26262-8 Clause 14 end to end, showing how the Poisson single-sided 70% bound turns vehicle-hours into a demonstrated failure rate, and why the numbers wall closes the argument far more often than it opens it.
How You Learn
Video and text stay in sync. As you scroll through the chapter, the video jumps to the matching explanation automatically.
Learning Objectives
Qualify a candidate correctly
Draw the candidate boundary and state the function and conditions you are actually allowed to claim credit for.
Freeze the service-history clock
Identify which revisions and updates reset the clock so only genuinely unchanged field hours count.
Reconstruct field data conservatively
Correct exposure and incident counts for a leaky reporting chain without over-claiming credit.
Run the Poisson 70% bound
Convert observed vehicle-hours and incidents into a demonstrated failure rate using the single-sided chi-squared bound.
Chapters
The Reuse Problem & Landscape
Why ISO 26262 accepts field history as safety evidence, why that offer is narrower than it sounds, and the eight reuse routes you should screen before betting on Clause 14.
The Candidate
Pinning down exactly what you are allowed to argue about: the boundary, the safety-relevant function, and the assumptions that define the candidate for qualification.
Change & Environment
Why every hardware revision or software update resets the service-history clock, so only the latest unchanged segment of field time actually counts toward your evidence.
Field Data
Reconstructing exposure and incidents through a leaky pipeline that runs from a field failure through symptom, workshop visit, diagnosis and report before it ever reaches your database.
The Statistics
How many vehicle-hours buy how much confidence, using the Poisson model and the single-sided 70% bound to convert observed incidents into a demonstrated failure rate.
Targets & the Numbers Wall
The per-ASIL rate targets and the fleet arithmetic that decides whether your data can ever reach them, at roughly 400 field hours per vehicle-year.
A Worked Example
One argument end to end for a hydraulic brake pressure sensor module at hardware revision B, from screening through the conservative chi-squared math to the verdict.
When It Actually Works
The honest success profile of a winning argument, the four killers that sink most attempts, and the hybrid forms that quietly dominate real practice.
Pre-Existing Software & ISO/PAS 8926
Why Clause 14 structurally fails for code, and the 2024 ISO/PAS 8926 route built to replace it, with its five-step evaluation flow.
Building the Argument
Assembling the work products and safety case, anticipating the assessor's questions, and avoiding the pitfalls that sink otherwise sound arguments.
Diagrams & Visuals
Service-History Reset Timeline
Shows field time accumulating and then being reset by a hardware revision and a software update, so only the latest configuration segment counts.
Field-Data Leakage Pipeline
Traces a failure from the field through symptom, workshop visit, diagnosis and report to your database, losing evidence at every stage.
Confidence Multiplier Curve
Plots the multiplier k against observed incidents, rising from 1.2 at zero incidents to 7.0 at five, driving the required hours.
Rate Target vs Fleet-Size Wall
A log-log view of observation years needed against fleet size that exposes where ASIL targets become unreachable.
Reuse Route Decision Map
Positions the eight reuse routes across the process, product and history evidence spectrum before you commit to Clause 14.
ISO/PAS 8926 Evaluation Flow
Walks the five-step evaluation flow for pre-existing software against the Clause 14 argument it replaces.
Qualifying a Carryover Brake Pressure Sensor via Field History
A hydraulic brake pressure sensor module at hardware revision B is carried over into a new program and put through a full proven-in-use argument against an ASIL B target of < 1.0 x 10^-8 / h. With T = 8.7 x 10^8 relevant vehicle-hours and r = 5 attributed incidents, the conservative chi-squared(0.70, 12) = 14.01 math decides whether the field data actually clears the wall.
- Candidate frozen at hardware revision B, boundary and function pinned before any hours are counted
- Service history reset on the last revision, leaving 8.7 x 10^8 h of relevant exposure
- Five attributed incidents reconstructed through the field-reporting chain
- Poisson single-sided 70% bound computed via chi-squared(0.70, 12) = 14.01
- Resulting rate compared against the ASIL B target of < 1.0 x 10^-8 / h
- Each quarterly OTA software version runs its own separate clock, not a shared pool
Qualification Worksheet: Brake Pressure Sensor Rev B
Master Proven in Use for Real Carryover Programs
Work through candidate qualification, the field-data chain, the Poisson statistics and a full worked example to know exactly when a field-history argument can close and when it cannot.
Start Learning Now