Structuring Safety Requirements in ISO 26262 Using Contract Theory

Abstract

Abstract. ISO 26262 -"Road vehicles-Functional Safety" is a standard for the automotive industry, administered in an attempt to prevent potential accidents due to systematic and random failures in the Electrical/Electronic-system. ISO 26262 is based on the principle of relying on safety requirements as the main source of information to enforce correctness of design. We show that the contract theory from the SPEEDS FP6 project provides a suitable foundation to structure safety requirements in ISO 26262. Contracts provide the necessary support to separate the responsibilities between a system and its environment by explicitly imposing requirements on the environment as assumptions, in order to guarantee the safety requirements. We show this by characterizing two levels of safety requirements with contracts for an industrial system where we also show how contract theory supports the verification of consistency and completeness of safety requirements.

Providing tool support for specifying safety-critical systems by enforcing syntactic contract conditions

“…1b, the assumption Lmeter can rather be seen as a requirement that is allocated to the potentiometer pot . This was also observed in [72,78] where, in the context of an architecture, assumptions are in fact references to other guarantees. Therefore, in the definition of a contract structure for a specific architecture in Sect.…”

“…Formulated differently, the guarantee lMeter is a requirement that is allocated to lMeter with the intent that lMeter is fulfilled if the assumption lMeter is fulfilled. This view is in accordance with [78] where guarantees are used to express safety requirements on elements.…”

“…The behavior of a non-leaf element (X, ) is the assertion that is the projection [73,75,78] of the intersection of the behaviors of its children (X i , i ) N i=1 onto the interface X; syntactically, is represented by the constraints, representing ⋂ N i=1 i , limited to be only over X. Formally, this is represented as =proj X ( ⋂ N i=1 i ) where p roj X denotes extended projection [73,74].…”

Environment-Centric Contracts for Design of Cyber-Physical Systems

“…Given a set of variables X , an assertion W over X is a possibly empty set of runs for X . This notion corresponds to similar definitions in [6,7,31]. Note that, in the following, assertions will be specified by equations.…”

“…a system, are formulated in order to prevent or mitigate hazards, where the hazards "shall be defined in terms of the conditions or behaviour that can be observed at the vehicle level" [29]. This can be observed in the industrial examples [30,31], where requirements that are not limited to the interface of components are necessarily used in order to properly express safety requirements on the components.…”