Integrated Automotive SPICE and safety assessments

Abstract

In 2005 Automotive SPICE (based on ISO 15504) has been published (see http://www.automot ivespice.com) and used in major automotive firms world wide. In parallel the topic 'Functional Safety' became important due to changes in liability law and the development of IEC 61508 as an application and branch independent standard for functional safety. As a result, ISO WD 26262 a ISO draft for functional safety has been initiated classifying systems with ASIL (automotive safety integrity levels) levels and requiring additional processes, techniques, and methods to illustrate the competence for managing systems that have an impact on the loss of lives.An Automotive SPICE assessment usually takes (for the processes defined in the scope of the German automotive manufacturing association) 4 days per project. Adding the scope of a safety assessment this dramatically increases the number of hours used in assessments. In a working group of major automotive suppliers and assessment tool suppliers, we developed from 2005 to 2009 an integrated assessment approach. Portals in the above-mentioned automotive suppliers already use this environment.The working group that elaborated the methods and tools described in this paper are part of the SOQRATES initiative (http://www.soqrates.de) where more than 20 leading German firms collaborate in cross-company task forces.In this paper, we want to explain the results of the analysis done, the assessment model applied, and what kind of reports the integrated assessment environment is producing. The results of all work (except of the proprietary assessment tools) will be made public to all suppliers in 2009.

Safety Design Strategies in Highly Autonomous Drive Level 2 – Lateral Control Decomposition Concept

“…The hazards typically include self-steering, blocking of steering, etc. [Messnarz 2009] [Messnarz 2016].…”

“…Hazard and risk analysis (HARA) and ASIL determination purpose is to determine the safety goals for the item to be able to prevent or mitigate the potential hazardous events caused by the item malfunction. Further elaboration of the safety goals then shall lead among others to the implementation of fault tolerance mechanisms that maintains the item in a safe state (with or without degradation) [ISO 26262 2011] [ISO 26262 2018] [Messnarz 2009] [Messnarz 2016. HARA is item specific; we have performed the analysis on the vehicle level for the "classic" platform vehicle on the market with the intent to identify fail-safe goals of such a classic platform and compare them to the fail-operational safety goals needed for HAD 2-3 design.…”

“…These assessments check such functional designs, effect chains and dynamic views. In ISO 26262 e.g., the safety critical signal flow is assessed [Macher 2017], [Macher 2017 b], in Automotive SPICE this is called dynamic view, and in cybersecurity norms [Macher 2017 b], [Messnarz 2020], ], [SAE 2016] this is also called a threat model with cybersecurity critical data, interfaces and functions.…”

Applying and Evaluating Architectural IEC 61508 Safety Patterns

“…Christopher Preschern, Nermin Kajtazovic, and Christian Kreiner [7] maps SPICE software development processes to functional safety artifacts defined in the safety standard. The selection and verification of IEC 61508 techniques and measures is integrated in the overall SPICE safety system development process.…”

Where does all this waste come from?

“…The construction of such systems utilizes quality assurance methodologies such as code reviews, testing and static code analysis. Industry‐relevant frameworks for process‐based quality assurance exist for process maturity (SPICE ) and security (Common Criteria ). A higher capability level in such a framework implies more processes accomplished at a higher level of maturity.…”