Bring the work you are stuck on. We check it, or we help you do it.

1. Deriveda

   SwSR-14: compare the two torque channels

   Software compares both channels every 2 ms and reports a fault after 3 consecutive deviations above the agreed limit. Derived from TSR-07 and timed so that detection and the safe reaction fit its 20 ms fault handling time interval.

   ISO 26262-6:2018, 6.4.1 and ISO 26262-4:2018, 6.4.2.2c

2. Derived

   HwSR-05: monitor each sensor supply

   Each sensor supply gets its own voltage monitor with a defined threshold. Derived from TSR-11, as the safety mechanism that controls a supply fault.

   ISO 26262-5:2018, 6.4.1 and 6.4.2

3. Derived

   The hardware-software interface, refined

   The monitor status registers and their read timing are recorded, so your hardware and software teams work from one definition.

   ISO 26262-5:2018, 6.4.10

4. Open point

   Losing both channels has no safe state

   Your concept defines the reaction when one channel fails, not when both do. We cannot derive these requirements until that is decided.

   Needed from you: Confirm the safe state for losing both channels, and we complete SwSR-19 and SwSR-20.b

   ISO 26262-4:2018, Clause 6

5. Traced

   Every requirement links both ways

   Each derived requirement names its source in your concept, and each technical safety requirement lists what was derived from it.

   ISO 26262-8:2018, 6.4.3.2

Illustrative example written for this page. Customer work stays confidential.

1. Delivereda

   The worksheet

   62 failure modes across 14 functions, each with its effect, its cause and the detection that exists today.

   ISO 26262-9:2018, 8.4.1c

2. Delivered

   The result against your safety goals

   The analysis says where the current design meets each safety goal and where it does not. Five failure modes have no detection today.

   ISO 26262-9:2018, 8.4.2

3. Delivered

   Proposed safety mechanisms

   One proposed mechanism for each of the five failure modes, written so it can go straight into your safety concept.

   ISO 26262-9:2018, Clause 8

4. Open point

   Two ratings wait for supplier data

   The ratings for the motor driver rest on an assumption until your supplier confirms its data. The assumption is recorded in the worksheet.

   Needed from you: Ask the supplier for the failure data, and we update the two rows.b

Illustrative example written for this page. Customer work stays confidential.

1. Answera

   At ASIL B it is a recommendation, not a requirement

   ISO 26262-5 writes both target requirements with ASIL B in parentheses, and a parenthesised ASIL turns a requirement into a recommendation. With no well-trusted design to derive your own targets from, the reference values for ASIL B are an SPFM of at least 90% and an LFM of at least 60%.

   ISO 26262-5:2018, 4.4, 8.4.5 and 8.4.6c

2. Worth knowing

   The two metrics tighten at different levels

   The SPFM requirement becomes mandatory from ASIL C. The LFM requirement stays a recommendation at ASIL C and only becomes mandatory at ASIL D.

   ISO 26262-5:2018, 8.4.5 and 8.4.6

Illustrative example written for this page. Customer work stays confidential.

1. Majora

   A safety goal names a solution

   SG-03 reads "use redundant torque sensors". A safety goal should state the functional objective. How you reach it belongs further down, in the safety concepts.

   Suggested fix: State the outcome to avoid, such as unwanted steering torque above an agreed limit, and move the redundancy into the functional or technical safety concept.b

   ISO 26262-3:2018, 6.4.4.1 and 6.4.4.3c

2. Major

   Exposure ratings have no rationale

   Nine of the 14 hazardous events carry an exposure class with no reason given. Each estimate needs a defined rationale, so nobody can confirm these ratings as they stand.

   Suggested fix: Add the source behind each rating, such as driving statistics or the operating time of the situation.

   ISO 26262-3:2018, 6.4.3.5

3. Minor

   A driver assumption is not listed

   The C2 ratings assume the driver keeps both hands on the wheel. That assumption affects the ASIL, so it should be identified and later validated on the integrated item.

   Suggested fix: List it with the other assumptions and add it to the safety validation scope.

   ISO 26262-3:2018, 6.4.4.4 and ISO 26262-4:2018, Clause 8

4. Checked

   The ASIL lookups are correct

   Every combination of severity, exposure and controllability matches the ASIL table. No change needed.

   ISO 26262-3:2018, 6.4.3.10

Illustrative example written for this page. Customer work stays confidential.

1. Majora

   Independence is not shown

   Both channels take their clock from one oscillator, so a single clock fault can reach both. The dependent failure analysis does not cover this coupling, so the decomposition has no evidence of sufficient independence.

   Suggested fix: Give each channel its own clock source, or add an independent clock monitor with a defined safe reaction. Then update the dependent failure analysis.b

   ISO 26262-9:2018, 5.4.3 and Clause 7c

2. Major

   Hardware metrics use the wrong target

   SPFM, LFM and PMHF are evaluated against ASIL B targets. Decomposition does not relax these evaluations, so the ASIL D targets still apply.

   Suggested fix: Recalculate the metrics against the ASIL D targets.

   ISO 26262-9:2018, 5.4.5

3. Checked

   The decomposition schema is valid

   Splitting ASIL D into ASIL B(D) and ASIL B(D) is one of the permitted schemas. No change needed.

   ISO 26262-9:2018, 5.4.9

Illustrative example written for this page. Customer work stays confidential.

1. Majora

   The HARA confirmation review is not independent enough

   A colleague from the department that wrote the HARA did the review. This review needs the highest independence level, I3: someone outside that department for management, resources and release authority.

   Suggested fix: Repeat the review with a reviewer from outside the department, such as a central safety team or an external reviewer.b

   ISO 26262-2:2018, 6.4.9.1, Table 1c

2. Major

   The functional safety assessment is not planned

   The safety plan has no entry for it. At this ASIL the assessment has to be planned and finished before release for production, and it should be carried out progressively during development.

   Suggested fix: Add it to the safety plan with a named assessor, its scope and its dates.

   ISO 26262-2:2018, 6.4.12.1 and 6.4.12.3

3. Minor

   Reports do not name a revision

   Three confirmation reports do not say which revision they covered. When an item changes, confirmation measures are repeated or extended, so you need to show exactly what each one looked at.

   Suggested fix: Add the work product name and revision to each report.

   ISO 26262-2:2018, 6.4.9.1, Notes 5 and 6

4. Checked

   The safety plan review meets I3

   The quality department reviewed the safety plan, outside the project's management and resources. That meets the level required at ASIL D. No change needed.

   ISO 26262-2:2018, 6.4.9.1, Table 1

Illustrative example written for this page. Customer work stays confidential.