Title: Safety Design Patterns | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/safety-design-patterns Description: Learn proven architectural patterns like redundancy, monitoring, watchdogs, and graceful degradation mapped to ASIL targets. --- Concept guide · ISO 26262-4/-6 · 12 chapters # Safety Design Patterns Apply proven architectural patterns for safety-critical automotive systems - from redundancy and voting to watchdog timers and graceful degradation. 12 Chapters 6 Interactive Diagrams 1 Case Study 1 Video Included in Pro Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsafety-design-patterns&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **Overview of Safety Patterns** 2. 02 **Redundancy Patterns** 3. 03 **Monitoring Patterns** 4. 04 **Voting & Consensus Patterns** 5. 05 **Graceful Degradation** The short version ## Quick answers What are safety design patterns in ISO 26262? Safety design patterns are proven architectural solutions for meeting ISO 26262 safety requirements: redundancy patterns (homogeneous and heterogeneous), monitoring patterns (master-monitor, checker-corrector, cross-channel), voting architectures (2oo2, 2oo3, k-of-n), graceful degradation, plausibility checking, watchdog timers and end-to-end communication protection. The standard does not prescribe specific patterns - it demands architectural measures for fault detection, control and tolerance scaled by ASIL - and these patterns are the industry vocabulary for satisfying those demands, each with known failure independence properties, diagnostic coverage characteristics and ASIL applicability that can be cited as evidence in the safety case. What is the difference between 2oo2 and 2oo3 voting? In a 2oo2 (two-out-of-two) architecture, two channels compute the result and both must agree for the output to be considered valid - it detects a single channel failure reliably, but cannot tell which channel failed, so disagreement forces a transition to the safe state and availability suffers. A 2oo3 architecture adds a third channel and votes majority: a single failed channel is outvoted, so the system detects the fault and keeps operating correctly. 2oo3 buys fault tolerance at the cost of hardware and a voter that becomes safety-critical itself - voter failure modes and common cause failures across channels must be analyzed explicitly. Keep going, free - [Article · 8 min read Architecting Automotive Systems with Proven Safety Patterns](https://iso26262.academy/blog/automotive-safety-patterns-iso-26262-architecture) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262, Part 4 ## Why it pays for itself ### Pick the right pattern per ASIL Use the pattern-by-ASIL matrix to select among redundancy, monitoring, voting, watchdog and degradation patterns based on failure mode, diagnostic coverage target and implementation constraints. ### Design redundancy that actually helps Compare homogeneous and heterogeneous redundancy and 2oo2, 2oo3 and k-of-n voting with their failure independence properties, common cause considerations and voter failure modes. ### Learn from the reference implementation Analyze the E-Gas 3-level monitoring concept as the production-proven case study - torque comparison, independent monitoring controller, watchdog IC and a four-state safe state machine at ASIL D. After the course ## What you’ll be able to do ### Select Appropriate Safety Patterns Choose the right safety design pattern based on ASIL, failure mode, diagnostic coverage target, and implementation constraints. ### Design Redundant Architectures Implement homogeneous and heterogeneous redundancy with proper independence analysis and CCF avoidance measures. ### Implement Effective Monitoring Apply master-monitor, cross-channel, and checker-corrector monitoring patterns with verifiable diagnostic coverage claims. ### Design Graceful Degradation Create multi-level degradation strategies with defined transition triggers, safe state behaviors, and recovery procedures. ### Protect Safety Communications Implement ISO 26262-compliant E2E protection for all safety-relevant communication paths with appropriate CRC profiles. ### Apply Patterns with ISO 26262 Evidence Document pattern implementation with ISO 26262 diagnostic coverage claims, ASIL attribution, and verification evidence. The curriculum · 12 chapters ## Chapter by chapter 1. 01 **Overview of Safety Patterns** Understand what safety design patterns are, why they matter, and how to select the right pattern for your ASIL. - Pattern taxonomy - Selection criteria - ASIL suitability 2. 02 **Redundancy Patterns** Compare homogeneous and heterogeneous redundancy patterns, their failure independence properties, and ASIL applicability. - Homogeneous vs heterogeneous - CCF considerations - ASIL decomposition 3. 03 **Monitoring Patterns** Apply internal and external monitoring patterns including master-monitor, checker-corrector, and cross-channel monitoring. - Master-monitor - Checker-corrector - Cross-channel 4. 04 **Voting & Consensus Patterns** Design 2oo2, 2oo3, and k-of-n voting architectures with fault detection and diagnostic coverage analysis. - 2oo2 vs 2oo3 - k-of-n generalization - Voter failure modes 5. 05 **Graceful Degradation** Implement multi-level degradation strategies that maintain safe operation across component failure combinations. - Degradation levels - Transition triggers - User notification 6. 06 **Plausibility Checking** Apply physical, temporal, and inter-signal plausibility checks to detect sensor and communication failures. - Physical limits - Gradient checks - Cross-signal validation 7. 07 **Watchdog Timer Patterns** Design windowed, complex question-answer, and logical watchdog mechanisms with coverage analysis. - Windowed watchdog - Q&A watchdog - Coverage claims 8. 08 **Communication Safety Patterns** Protect safety-relevant communication with E2E protection, sequence counters, and alive counters per ISO 26262. - E2E profiles - Sequence counter - CRC selection 9. 09 **Software Safety Patterns** Apply software-specific patterns: diverse redundancy, memory protection, control flow monitoring, and data integrity. - Control flow check - Memory test patterns - Data integrity 10. 10 **E-Gas Case Study** Analyze the E-Gas 3-level monitoring concept as the reference implementation of safety design patterns in production. - 3 monitoring levels - Torque structure - Safety state machine 11. 11 **ASIL Mapping** Map each safety design pattern to applicable ASILs with diagnostic coverage claims and ISO 26262 references. - Pattern × ASIL matrix - DC claims - Standard references 12. 12 **Implementation Guidelines** Apply practical implementation guidance, verification techniques, and common pitfalls for each pattern category. - Implementation tips - Verification approach - Common mistakes Interactive Diagrams ## Not just text: the visual toolkit ### Redundancy Architecture Visualizer Compare homogeneous and heterogeneous redundancy configurations with failure independence and CCF analysis. ### Voting System Designer Design and analyze 2oo2, 2oo3, and k-of-n voting architectures with fault coverage calculations. ### Degradation State Machine Model multi-level graceful degradation with transition triggers, safe states, and recovery paths. ### Watchdog Coverage Analyzer Evaluate diagnostic coverage of different watchdog configurations against ISO 26262 Annex D criteria. ### E2E Protection Selector Select the appropriate E2E protection profile based on data length, ASIL, and transmission timing. ### Pattern × ASIL Matrix Explore the suitability matrix of all safety design patterns against ASIL A through D requirements. Real-World Application ## E-Gas 3-Level Monitoring Architecture - Industry Reference Implementation Analyze the Electronic Gas (E-Gas) 3-level monitoring concept used in production engine and powertrain controllers as the definitive example of safety design patterns in automotive. - Level 1: Functional monitoring - torque structure with driver demand vs output comparison at 10 ms - Level 2: Functional monitoring - independent monitoring controller checks Level 1 at 20 ms cycle - Level 3: Hardware monitoring - dedicated watchdog IC verifies both ECU cores independently - Safe state machine: 4 states with defined transition conditions, timing, and recovery criteria - ASIL D compliance achieved through heterogeneous redundancy with independence argument E-Gas State Machine State 2 → State 3: Torque deviation > 5 Nm for > 50 ms - Throttle limp home activated Unlock in course Built for ## Who this guide is for - Software and system architects designing their first ASIL-rated architecture - Engineers choosing between 1oo2, 2oo2 and 2oo3 configurations for a safety function - Teams that need defensible diagnostic coverage claims for watchdogs and monitors - Reviewers evaluating whether a proposed architecture actually supports its ASIL ## Frequently Asked Questions Common questions about Safety Design Patterns A simple watchdog only proves the processor is alive enough to kick it. A windowed watchdog requires the kick inside a defined time window - too early is as suspicious as too late - which catches runaway loops that kick constantly. A question-and-answer watchdog goes further: the monitored processor must compute correct answers to challenges, proving it can still execute logic correctly, and a logical watchdog checks program flow sequence. Each step up increases the diagnostic coverage you can defensibly claim, which is why the guide pairs each configuration with coverage analysis rather than treating all watchdogs as equal. ASIL D architectures typically combine patterns rather than rely on one: heterogeneous redundancy or a monitoring channel with an argued independence claim, hardware-supported monitoring such as a separate watchdog IC, end-to-end protection on safety-relevant communication, and defined graceful degradation into safe states. The production reference is the E-Gas 3-level concept: functional level, independent monitoring controller and dedicated watchdog IC, achieving ASIL D through heterogeneous redundancy with an explicit independence argument. The guide maps every pattern against ASIL A through D with diagnostic coverage claims and standard references, so the selection is evidence-based rather than habit. The guide has 12 chapters spanning redundancy, monitoring, voting, graceful degradation, plausibility checking, watchdog, communication and software safety patterns, plus ASIL mapping and implementation guidelines. Six interactive diagrams let you explore redundancy configurations, voting design, degradation state machines, watchdog coverage, E2E profile selection and the pattern-by-ASIL matrix, and the E-Gas 3-level monitoring case study anchors everything in a production architecture. A free account starts you off, and the Pro and Expert plans unlock more of the library. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsafety-design-patterns&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)