ISO 26262:2018 - Functional Safety for Road Vehicles

Apply ASIL decomposition with demonstrated independence between decomposed elements.

• Decomposition analysis
• Independence argument
• CCF analysis
• Allocation record

• Independence unproven
• CCF ignored
• Decomposition unjustified

Conduct deductive and inductive safety analyses appropriate to ASIL covering both random and systematic failures.

• FMEA
• FTA
• Common cause analysis
• Analysis reports

• FMEA shallow
• FTA missing
• Common cause not addressed

Define the item under development including its boundaries, functions, interfaces, and operational environment.

• Item definition document
• Boundary diagram
• Interface specification
• Operating conditions list

• Boundaries unclear
• Interfaces missing
• Environment not described

Identify hazardous events, classify ASIL based on severity, exposure, and controllability, and determine safety goals.

• HARA report
• Hazard catalogue
• ASIL determination records
• Safety goals list

• HARA incomplete
• ASIL rationale missing
• Safety goals not derived

Derive functional safety requirements from safety goals and allocate them to architecture elements.

• Functional safety concept document
• Requirements traceability
• Architecture allocation
• Decomposition analysis

• No traceability
• Allocation unclear
• Decomposition missing

Derive hardware safety requirements from the technical safety concept and allocate them to hardware components.

• Hardware safety requirements specification
• Allocation matrix
• Traceability records
• Review minutes

• Allocation absent
• Traceability gaps
• Reviews not conducted

Design hardware architecture and units to meet safety requirements, considering systematic and random failures.

• Hardware design specification
• FMEDA
• FTA
• Schematics

• FMEDA absent
• FTA missing
• Schematics incomplete

Calculate and evaluate single point fault metric and latent fault metric against ASIL targets.

• SPFM calculation
• LFM calculation
• Diagnostic coverage analysis
• Target compliance report

• Metrics not calculated
• Targets unmet
• Coverage unclear

Evaluate probabilistic metric for hardware failures or apply evaluation of each cause of safety goal violation.

• PMHF calculation
• Failure rate sources
• Evaluation report
• Justification document

• Sources not cited
• PMHF unjustified
• Report missing

Establish a functional safety management system encompassing organization, processes, and competence for the safety lifecycle.

• Safety management plan
• Organization chart with safety roles
• Competence matrix
• Process inventory

• No safety manager appointed
• Competence not assessed
• Plan absent

Tailor safety management to each project including planning, monitoring, and confirmation measures.

• Project safety plan
• Tailoring rationale
• Confirmation measures schedule
• Status reports

• No tailoring rationale
• Confirmation measures missing
• Reporting absent

Requirements for planning and coordination of safety activities throughout the safety lifecycle.

• Safety management plan
• Safety culture assessment
• Confirmation review report
• ASIL register

• No defined safety lifecycle owner
• Safety culture not measured
• Confirmation reviews skipped on ASIL-D items

Requirements for managing functional safety during the concept phase and product development.

• Safety management plan
• Safety culture assessment
• Confirmation review report
• ASIL register

• No defined safety lifecycle owner
• Safety culture not measured
• Confirmation reviews skipped on ASIL-D items

Requirements for safety management after the item has been released for production.

• Safety management plan
• Safety culture assessment
• Confirmation review report
• ASIL register

• No defined safety lifecycle owner
• Safety culture not measured
• Confirmation reviews skipped on ASIL-D items

Requirements for establishing and maintaining a safety culture within the organization.

• Safety management plan
• Safety culture assessment
• Confirmation review report
• ASIL register

• No defined safety lifecycle owner
• Safety culture not measured
• Confirmation reviews skipped on ASIL-D items

Requirements for confirmation reviews, functional safety audits, and safety assessments.

• Safety management plan
• Safety culture assessment
• Confirmation review report
• ASIL register

• No defined safety lifecycle owner
• Safety culture not measured
• Confirmation reviews skipped on ASIL-D items

Requirements for defining the item including its functionality, interfaces, environmental conditions, and known hazards.

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for determining whether the item is a new development or modification and identifying applicable safety activities.

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for identifying hazardous events and classifying them using ASIL (Automotive Safety Integrity Levels).

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for deriving the functional safety concept including safety goals and safe states.

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for assessment to judge the functional safety achieved and identify potential shortfalls.

• Technical safety requirements
• System design document
• Integration test report
• Safety validation report

• Requirements not bidirectionally traceable
• Validation scenarios incomplete
• Assessment independence weak

Requirements for planning system-level development activities based on the functional safety concept.

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for deriving technical safety requirements from the functional safety concept.

• Technical safety requirements
• System design document
• Integration test report
• Safety validation report

• Requirements not bidirectionally traceable
• Validation scenarios incomplete
• Assessment independence weak

Requirements for system design that implements technical safety requirements.

• Technical safety requirements
• System design document
• Integration test report
• Safety validation report

• Requirements not bidirectionally traceable
• Validation scenarios incomplete
• Assessment independence weak

Requirements for integration and testing of the item to verify that safety requirements are met.

• Technical safety requirements
• System design document
• Integration test report
• Safety validation report

• Requirements not bidirectionally traceable
• Validation scenarios incomplete
• Assessment independence weak

Requirements for validating that the safety goals are achieved by the item at the vehicle level.

• Technical safety requirements
• System design document
• Integration test report
• Safety validation report

• Requirements not bidirectionally traceable
• Validation scenarios incomplete
• Assessment independence weak

Requirements for integration and verification testing of hardware elements.

• Hardware safety requirements
• FMEDA report
• PMHF calculations
• Hardware test report

• SPFM/LFM targets not met
• Random failure metrics unjustified
• Hardware fault injection skipped

Requirements for planning hardware-level development activities including safety analysis techniques.

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for deriving hardware safety requirements from the technical safety concept.

• Hardware safety requirements
• FMEDA report
• PMHF calculations
• Hardware test report

• SPFM/LFM targets not met
• Random failure metrics unjustified
• Hardware fault injection skipped

Requirements for hardware design, including design for diagnostic capabilities and fault detection.

• Hardware safety requirements
• FMEDA report
• PMHF calculations
• Hardware test report

• SPFM/LFM targets not met
• Random failure metrics unjustified
• Hardware fault injection skipped

Requirements for evaluating hardware using single-point fault metric, latent fault metric, and diagnostic coverage.

• Hardware safety requirements
• FMEDA report
• PMHF calculations
• Hardware test report

• SPFM/LFM targets not met
• Random failure metrics unjustified
• Hardware fault injection skipped

Requirements for quantitative analysis of random hardware failure rates against ASIL targets.

• Hardware safety requirements
• FMEDA report
• PMHF calculations
• Hardware test report

• SPFM/LFM targets not met
• Random failure metrics unjustified
• Hardware fault injection skipped

Requirements for integration testing to verify correct interaction between software components.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for verifying that all software safety requirements have been correctly implemented.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for planning software-level development including design and testing methods based on ASIL.

• Item definition document
• HARA matrix
• Functional safety concept
• Safety goals register

• Operational situations under-enumerated
• ASIL determination not justified
• Safety goals not traced to hazards

Requirements for deriving software safety requirements from the technical safety concept and system design.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for software architecture including freedom from interference, modularity, and error detection.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for unit-level design and coding including coding guidelines and design principles.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for unit testing including structural coverage metrics and requirements-based testing.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for production processes to ensure functional safety is maintained during manufacturing.

• Production safety plan
• Field monitoring report
• Recall procedure
• Decommissioning record

• Field data not fed back to safety case
• Service instructions incomplete
• Decommissioning not documented

Requirements for maintaining functional safety during the operational lifetime of the vehicle.

• Production safety plan
• Field monitoring report
• Recall procedure
• Decommissioning record

• Field data not fed back to safety case
• Service instructions incomplete
• Decommissioning not documented

Requirements for ensuring safe decommissioning of safety-related systems.

• Production safety plan
• Field monitoring report
• Recall procedure
• Decommissioning record

• Field data not fed back to safety case
• Service instructions incomplete
• Decommissioning not documented

Requirements for documentation of safety-related activities and work products.

• Safety case document
• Configuration baseline
• Change request log
• Verification plan

• Safety case not maintained
• Baselines missing for releases
• Change impact analysis weak

Requirements for qualifying software tools used in the development of safety-related systems.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for qualifying software components not developed according to ISO 26262.

• Software safety requirements
• Software architecture spec
• Unit test report
• MISRA compliance log

• Coding guidelines deviations untracked
• Coverage targets unmet for ASIL-D
• Tool qualification missing

Requirements for qualifying hardware components not developed according to ISO 26262.

• Hardware safety requirements
• FMEDA report
• PMHF calculations
• Hardware test report

• SPFM/LFM targets not met
• Random failure metrics unjustified
• Hardware fault injection skipped

Requirements for providing a proven-in-use argument for previously developed elements.

• Tool classification analysis (TCL)
• Tool qualification report
• Proven-in-use argument
• Component qualification record

• TCL not justified
• Qualification evidence stale
• Proven-in-use data insufficient

Requirements for managing safety across distributed development involving multiple parties.

• Safety case document
• Configuration baseline
• Change request log
• Verification plan

• Safety case not maintained
• Baselines missing for releases
• Change impact analysis weak

Requirements for specifying, managing, and tracking safety requirements throughout the lifecycle.

• Safety case document
• Configuration baseline
• Change request log
• Verification plan

• Safety case not maintained
• Baselines missing for releases
• Change impact analysis weak

Requirements for configuration management of safety-related work products.

• Safety case document
• Configuration baseline
• Change request log
• Verification plan

• Safety case not maintained
• Baselines missing for releases
• Change impact analysis weak

Requirements for managing changes to items, elements, or work products with impact on functional safety.

• Safety case document
• Configuration baseline
• Change request log
• Verification plan

• Safety case not maintained
• Baselines missing for releases
• Change impact analysis weak

Requirements for verification methods including reviews, inspections, walk-throughs, and testing.

• Safety case document
• Configuration baseline
• Change request log
• Verification plan

• Safety case not maintained
• Baselines missing for releases
• Change impact analysis weak

Requirements for ASIL decomposition to allocate safety requirements to redundant elements.

• ASIL decomposition rationale
• Coexistence analysis
• Dependent failure analysis (DFA)
• FTA/FMEA report

• Decomposition independence not proven
• DFA scope incomplete
• Safety analyses not iterated

Requirements for ensuring coexistence of elements with different ASILs without interference.

• ASIL decomposition rationale
• Coexistence analysis
• Dependent failure analysis (DFA)
• FTA/FMEA report

• Decomposition independence not proven
• DFA scope incomplete
• Safety analyses not iterated

Requirements for analyzing and managing dependent failures including common cause and cascading failures.

• ASIL decomposition rationale
• Coexistence analysis
• Dependent failure analysis (DFA)
• FTA/FMEA report

• Decomposition independence not proven
• DFA scope incomplete
• Safety analyses not iterated

Requirements for performing qualitative and quantitative safety analyses such as FMEA, FTA, and FMEDA.

• ASIL decomposition rationale
• Coexistence analysis
• Dependent failure analysis (DFA)
• FTA/FMEA report

• Decomposition independence not proven
• DFA scope incomplete
• Safety analyses not iterated

Plan and control production processes to ensure safety relevant characteristics are achieved consistently.

• Production control plan
• End of line test records
• Process capability data
• Nonconformance log

• Control plan absent
• Capability not measured
• Nonconformances unmanaged

Plan for safe operation, service, repair, and decommissioning including field monitoring and user information.

• Field monitoring plan
• Service manuals
• Repair procedures
• Decommissioning instructions

• Field data not collected
• Service manuals missing
• Decommissioning ignored

Integrate software components and verify integration against architecture and safety requirements.

• Integration plan
• Integration test specifications
• Test reports
• Coverage analysis

• Plan missing
• Reports incomplete
• Coverage absent

Derive software safety requirements and allocate them to software architecture and units.

• Software safety requirements
• Allocation matrix
• Traceability records
• Review minutes

• Traceability absent
• Reviews not done
• Allocation missing

Design software architecture using ASIL appropriate methods such as freedom from interference and decomposition.

• Architecture document
• Freedom from interference analysis
• Decomposition rationale
• Review records

• FFI not analysed
• Decomposition unsupported
• Reviews absent

Implement software units according to coding guidelines and ASIL appropriate methods.

• Coding guidelines
• MISRA compliance reports
• Static analysis results
• Code review records

• Guidelines absent
• Static analysis missing
• Reviews superficial

Verify software units through testing and analysis with structural coverage appropriate to ASIL.

• Unit test specifications
• Test results
• Coverage reports
• Tool qualification records

• Coverage low
• Tools not qualified
• Results undocumented

Qualify software tools used in development based on tool impact and detection levels.

• Tool inventory
• TCL classification
• Qualification report
• Usage procedure

• Tools unclassified
• No qualification
• Procedures missing

Qualify pre existing software components for use in safety related items through evidence of suitability.

• Qualification plan
• Test results
• Field data
• Compatibility analysis

• Plan absent
• Field data missing
• Compatibility unverified

Specify, manage, and trace safety requirements throughout the lifecycle including change control.

• Requirements management plan
• Traceability matrix
• Change records
• Review records

• Traceability absent
• Changes uncontrolled
• Reviews not held

Derive technical safety requirements and a technical safety concept including safety mechanisms.

• Technical safety concept
• Safety mechanism list
• Diagnostic coverage analysis
• System architecture diagram

• Mechanisms undocumented
• Diagnostic coverage unclear
• Architecture missing

Integrate hardware and software, and conduct testing against technical safety requirements and ASIL appropriate methods.

• Integration plan
• Test specifications
• Test reports
• Coverage analysis

• Plan absent
• Coverage low
• Reports missing

Validate that the item satisfies the safety goals under intended operating conditions.

• Validation plan
• Validation specifications
• Validation report
• Acceptance criteria

• Plan missing
• Conditions not covered
• Acceptance criteria absent