Emergency Operation in the Power Supply Domain According to ISO 26262

Abstract

The automotive industry is currently driven by the megatrends electrification, automated driving, and connectivity. To cope with these trends, new functionalities and electric and/or electronic systems must be developed, which require a safe power supply by the power supply system. This leads to increased functional safety requirements for the power supply system, particularly regarding availability. Fault tolerance measures can be implemented to address a safety goal specifying a safety-related availability requirement. In this case, emergency operation (EO) may be necessary to reach a defined safe state. The definitions and examples provided in ISO 26262 focus on cold redundancy, whereby the backup system is not engaged during nominal operation. The objective of this paper is to evaluate EO in the context of ISO 26262 in detail and map the results to an exemplary power supply system architecture implementing cold redundancy. In general, the EO is considered to be free from unreasonable risk even though the actual automotive safety integrity level (ASIL) capability of the item is lower than the initially specified ASIL rating for the hazard due to its timing restrictions. To determine the maximum permissible duration of EO, not just random hardware faults shall be considered; additionally, systematic effects shall be considered. Furthermore, an EO may be entered due to transient faults potentially causing temporary EOs -introducing the necessity of an EO recording, e.g. by accumulating the time of all temporary EOs.

Emergency Operation in the Power Supply Domain Focusing on Warm Redundancy

“…[1], [8], [9], [10], [11], [12] or [13]. Main safety requirements for the power supply system are [1], [3], [4], [8]: 1) provide safe power feed; 2) provide safe power distribution; and 3) ensure freedom from interference.…”

“…For comparability to [4] -focusing on EO in the context of cold redundancy -the same use case as provided in Table 1 in [4] is considered within this paper, too. Thus, the SG "Prevent sudden loss of steering assist" shall be fulfilled by the steering entity -rated with ASIL C [1], [3], [4]. The entity concept in general was described in [14].…”

“…The entity concept in general was described in [14]. If the steering assist functionality is suddenly lost, a hazardous event potentially occurs [3], [4]. Thus, a SaRA requirement is specified for the steering entity, which is applicable during VOS driving but, e.g., not in vehicle standstill [3], [4].…”

“…If the steering assist functionality is suddenly lost, a hazardous event potentially occurs [3], [4]. Thus, a SaRA requirement is specified for the steering entity, which is applicable during VOS driving but, e.g., not in vehicle standstill [3], [4]. VOS is defined as the "operating mode in combination with the operational situation" [7].…”

“…According to ISO 26262, an EO is entered if a hazard is prevented from occurring but a safe state cannot be reached within the FHTImax respectively FTTI. As evaluated in [4], the guidelines and requirements in ISO 26262 implicitly focus on cold redundancy with a fault in the main system -potentially, directly violating an SG. There are ambiguities and inconsistencies when applying these to faults in backup systems.…”