Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems

Transcription

1 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems SARE-väst, Urban Ingelsson Safety-Critical Systems Competence Center

2 What is functional safety? Absence of unreasonable risk due to hazards caused by malfunctioning behavior of E/E systems Brakes, steering, Electronics and software could cause an accident certifiably safe embedded systems in automotive context ISO Functional Safety Road Vehicles 2 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

3 Effort Criticality ISO Structured way of working Scope Specification and management of requirements Hazard analysis and risk assessment Automotive Safety Integrity Levels ASIL ASIL D ASIL C ASIL B ASIL A Quality Management (QM) 3 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

4 Case study Windshield Wiper Washer Liquid Spray Activate Wiper Activate Windshield controller Washer Liquid Spray Enable Wiper Enable Wiper Angle Is it a safety-related function? 4 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

5 Hazard Analysis and Risk Assessment The driver s view might be obscured Failure mode Contineous spray of washer liquid Driving situation High speed, curvy road, medium traffic Exposure High Controllability Medium Severity High ASIL D ASIL C ASIL B ASIL A Quality Management (QM) Safety goal A malfunction shall not lead to the driver s view being obscured 5 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

6 Functions Driving situations Design patterns Hazard Analysis Hazards Risk Assessment Safety goals with ASIL classification Fault tolerant time interval Analysis of functions and safety goals Safety goal violations Analysis to choose safety measure to mitigate safety goal violations HAZOP, etc. Exposure Controlability Severity FTA, etc. Design space exploration Compare design patterns Safety measures Formulate functional safety requirements Functional safety requirements Quality attributes, notation, etc. 6 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

7 ASIL C? It takes much effort! Reduce effort by requirement decomposition! A divide-and-conquer approach Encourages use of safe architectures 2 independent modules freedom from interference lower ASIL --- typically less effort Req A1 ASIL B(C) Req A ASIL C Req A2 ASIL A(C) A A1 A2 ASIL C ASIL B(C) + ASIL A(C) ASIL D ASIL B(D) + ASIL B(D) ASIL D ASIL D(D) + QM(D) 7 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

8 FSR1 The washer liquid spray shall not be enabled for >5s FSR2 The washer liquid spray shall not be enabled for >1s if the wiper is inoperational Washer Liquid Spray Activate Wiper Activate Windshield controller ASIL C Wiper Enable Wiper Angle Washer Liquid Spray Enable FSR3 The washer liquid spray controller shall disable the washer liquid spray, if the windshield wiper angle is constant for >1s FSR4 The wiper controller shall disable the washer liquid spray, if the washer liquid spray is enabled for >5s 8 Washer liquid spray controller ASIL A(C) Decomposition Washer Liquid Spray Activate Wiper Activate Wiper Angle Wiper Enable Washer Liquid Spray Enable Override Wiper controller ASIL B(C)

9 Quality attributes for requirements Each requirement Uniquely identified Allocated in the design Unambiguous Comprehensible Atomic Internally consistent Feasible Verifiable High ASIL: spec. in semi-formal notation Traceable 9 Up and down the hierarchy Verification activities, operating modes and system states The set of requirements Organized in a hierarchy Complete Grouped Consistent Maintainable Free from duplicated information

10 Safety goal SG1: A malfunction shall not lead to the driver s view being obscured Functional safety FSR3: The washer liquid spray controller shall disable the washer liquid spray, if the windshield wiper angle is constant for >1s FSR4: The wiper controller shall disable the washer liquid spray, if the washer liquid spray is enabled for >5s Technical safety TSR42: Counter1 shall be reset within 20ms when Comparator3 indicates that PreviousAnglePWM anglepwm SW SWSR50: Control loop L1 shall reset Counter1 if Comparator3.output == false HW HWSR71: Register anglepwm shall connect on the same bus as inputa of Comparator3 10 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

11 Conclusion The impact of ISO Requirement-heavy ASIL Quality attributes, traceability and semi-formal notation Effort Architecture 11 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems,

12 Introduction to Requirement Management for Safety-Critical Embedded Vehicle Systems SARE-väst, Urban Ingelsson Safety-Critical Systems Competence Center