ISO 26262-10:2018
Road vehicles — Functional safety — Part 10: Guidelines on ISO 26262
This document is intended to be applied to safety-related systems that include one or more electrical and/or electronic (E/E) systems and that are installed in series production road vehicles, excluding mopeds. This document does not address unique E/E systems in special vehicles such as E/E systems designed for drivers with disabilities.
NOTE Other dedicated application-specific safety standards exist and can complement the ISO 26262 series of standards or vice versa.
Systems and their components released for production, or systems and their components already under development prior to the publication date of this document, are exempted from the scope of this edition. This document addresses alterations to existing systems and their components released for production prior to the publication of this document by tailoring the safety lifecycle depending on the alteration. This document addresses integration of existing systems not developed according to this document and systems developed according to this document by tailoring the safety lifecycle.
This document addresses possible hazards caused by malfunctioning behaviour of safety-related E/E systems, including interaction of these systems. It does not address hazards related to electric shock, fire, smoke, heat, radiation, toxicity, flammability, reactivity, corrosion, release of energy and similar hazards, unless directly caused by malfunctioning behaviour of safety-related E/E systems.
This document describes a framework for functional safety to assist the development of safety-related E/E systems. This framework is intended to be used to integrate functional safety activities into a company-specific development framework. Some requirements have a clear technical focus to implement functional safety into a product; others address the development process and can therefore be seen as process requirements in order to demonstrate the capability of an organization with respect to functional safety.
This document does not address the nominal performance of E/E systems.
This document provides an overview of the ISO 26262 series of standards, as well as giving additional explanations, and is intended to enhance the understanding of the other parts of the ISO 26262 series of standards. It has an informative character only and describes the general concepts of the ISO 26262 series of standards in order to facilitate comprehension. The explanation expands from general concepts to specific contents.
In the case of inconsistencies between this document and another part of the ISO 26262 series of standards, the requirements, recommendations and information specified in the other part of the ISO 26262 series of standards apply.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$361.74 NZD
|
|
| HardCopy |
$406.09 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Key concepts of ISO 26262
4.1 Functional safety for automotive systems (relationship with IEC 61508[1])
4.2 Item, system, element, component, hardware part and software unit
4.3 Relationship between faults, errors and failures
4.3.1 Progression of faults to errors to failures
4.4 FTTI and emergency operation tolerant time interval
4.4.1 Introduction
4.4.2 Timing model — Example control system
5 Selected topics regarding safety management
5.1 Work product
5.2 Confirmation measures
5.2.1 General
5.2.2 Functional safety assessment
5.3 Understanding of safety cases
5.3.1 Interpretation of safety cases
5.3.2 Safety case development lifecycle
6 Concept phase and system development
6.1 General
6.2 Example of hazard analysis and risk assessment
6.2.1 General
6.2.2 HARA example 1
6.2.3 HARA example 2
6.3 An observation regarding controllability classification
6.4 External measures
6.4.1 General
6.4.2 Example of vehicle dependent external measures 1
6.4.3 Example of vehicle dependent external measures 2
6.5 Example of combining safety goals
6.5.1 Introduction
6.5.2 General
6.5.3 Function definition
6.5.4 Safety goals applied to the same hazard in different situations
7 Safety process requirement structure — Flow and sequence of the safety requirements
8 Concerning hardware development
8.1 The classification of random hardware faults
8.1.1 General
8.1.2 Single-point fault
8.1.3 Residual fault
8.1.4 Detected dual-point fault
8.1.5 Perceived dual-point fault
8.1.6 Latent dual-point fault
8.1.7 Safe fault
8.1.8 Flow diagram for fault classification and fault class contribution calculation
8.1.9 How to consider the failure rate of multiple-point faults related to software-based safety mechanisms addressing random hardware failures
8.2 Example of residual failure rate and local single-point fault metric evaluation
8.2.1 General
8.2.2 Technical safety requirement for sensor A_Master
8.2.3 Description of the safety mechanism
8.2.4 Evaluation of example 1 described in Figure 12
8.3 Further explanation concerning hardware
8.3.1 How to deal with microcontrollers in the context of an ISO 26262 series of standards application
8.3.2 Safety analysis methods
8.4 PMHF units — Average probability per hour
9 Safety Element out of Context
9.1 Safety Element out of Context development
9.2 Use cases
9.2.1 General
9.2.2 Development of a system as a Safety Element out of Context example
9.2.3 Development of a hardware component as a Safety Element out of Context example
9.2.4 Development of a software component as a Safety Element out of Context example
10 An example of proven in use argument
10.1 General
10.2 Item definition and definition of the proven in use candidate
10.3 Change analysis
10.4 Target values for proven in use
11 Concerning ASIL decomposition
11.1 Objective of ASIL decomposition
11.2 Description of ASIL decomposition
11.3 An example of ASIL decomposition
11.3.1 General
11.3.2 Item definition
11.3.3 Hazard analysis and risk assessment
11.3.4 Associated safety goal
11.3.5 System architectural design
11.3.6 Functional safety concept
12 Guidance for system development with safety-related availability requirements
12.1 Introduction
12.2 Notes on concept phase when specifying fault tolerance
12.2.1 General
12.2.2 Vehicle operating states in which the availability of a functionality is safety-related
12.2.3 Prevention of hazardous events after a fault
12.2.4 Operation after fault reaction
12.2.5 Fault tolerant item example
12.2.6 ASIL decomposition of fault tolerant items
12.3 Availability considerations during hardware design phase
12.3.1 Random hardware fault quantitative analysis
12.4 Software development phase
12.4.1 Software fault avoidance and tolerance
12.4.2 Software fault avoidance
12.4.3 Software fault tolerance
13 Remark on “Confidence in the use of software tools”
14 Guidance on safety-related special characteristics
14.1 General
14.2 Identification of safety-related special characteristics
14.3 Specification of the control measures of safety-related special characteristics
14.4 Monitoring of the safety-related special characteristics
Annex A (informative) Fault tree construction and applications
Bibliography
Previous versions
Keep me up-to-date
Register to receive notifications when updates are made to this standard.
Related Information
Similar Standards
-
AS/NZS 5377:2013
Collection, storage, transport and treatment of end-of-life electrical and electronic equipment -
BS AU 16a:1989
Specification for electrical cable connectors (17.5 A maximum continuous rating)
-
BS AU 237a:1993
Specification for light domestic duty jumper lead sets for automotive starting
-
BS AU 250:1993
Specification for mounting dimensions of alternators, types 1, 2 and 3 for commercial vehicles and buses
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Key concepts of ISO 26262
4.1 Functional safety for automotive systems (relationship with IEC 61508[1])
4.2 Item, system, element, component, hardware part and software unit
4.3 Relationship between faults, errors and failures
4.3.1 Progression of faults to errors to failures
4.4 FTTI and emergency operation tolerant time interval
4.4.1 Introduction
4.4.2 Timing model — Example control system
5 Selected topics regarding safety management
5.1 Work product
5.2 Confirmation measures
5.2.1 General
5.2.2 Functional safety assessment
5.3 Understanding of safety cases
5.3.1 Interpretation of safety cases
5.3.2 Safety case development lifecycle
6 Concept phase and system development
6.1 General
6.2 Example of hazard analysis and risk assessment
6.2.1 General
6.2.2 HARA example 1
6.2.3 HARA example 2
6.3 An observation regarding controllability classification
6.4 External measures
6.4.1 General
6.4.2 Example of vehicle dependent external measures 1
6.4.3 Example of vehicle dependent external measures 2
6.5 Example of combining safety goals
6.5.1 Introduction
6.5.2 General
6.5.3 Function definition
6.5.4 Safety goals applied to the same hazard in different situations
7 Safety process requirement structure — Flow and sequence of the safety requirements
8 Concerning hardware development
8.1 The classification of random hardware faults
8.1.1 General
8.1.2 Single-point fault
8.1.3 Residual fault
8.1.4 Detected dual-point fault
8.1.5 Perceived dual-point fault
8.1.6 Latent dual-point fault
8.1.7 Safe fault
8.1.8 Flow diagram for fault classification and fault class contribution calculation
8.1.9 How to consider the failure rate of multiple-point faults related to software-based safety mechanisms addressing random hardware failures
8.2 Example of residual failure rate and local single-point fault metric evaluation
8.2.1 General
8.2.2 Technical safety requirement for sensor A_Master
8.2.3 Description of the safety mechanism
8.2.4 Evaluation of example 1 described in Figure 12
8.3 Further explanation concerning hardware
8.3.1 How to deal with microcontrollers in the context of an ISO 26262 series of standards application
8.3.2 Safety analysis methods
8.4 PMHF units — Average probability per hour
9 Safety Element out of Context
9.1 Safety Element out of Context development
9.2 Use cases
9.2.1 General
9.2.2 Development of a system as a Safety Element out of Context example
9.2.3 Development of a hardware component as a Safety Element out of Context example
9.2.4 Development of a software component as a Safety Element out of Context example
10 An example of proven in use argument
10.1 General
10.2 Item definition and definition of the proven in use candidate
10.3 Change analysis
10.4 Target values for proven in use
11 Concerning ASIL decomposition
11.1 Objective of ASIL decomposition
11.2 Description of ASIL decomposition
11.3 An example of ASIL decomposition
11.3.1 General
11.3.2 Item definition
11.3.3 Hazard analysis and risk assessment
11.3.4 Associated safety goal
11.3.5 System architectural design
11.3.6 Functional safety concept
12 Guidance for system development with safety-related availability requirements
12.1 Introduction
12.2 Notes on concept phase when specifying fault tolerance
12.2.1 General
12.2.2 Vehicle operating states in which the availability of a functionality is safety-related
12.2.3 Prevention of hazardous events after a fault
12.2.4 Operation after fault reaction
12.2.5 Fault tolerant item example
12.2.6 ASIL decomposition of fault tolerant items
12.3 Availability considerations during hardware design phase
12.3.1 Random hardware fault quantitative analysis
12.4 Software development phase
12.4.1 Software fault avoidance and tolerance
12.4.2 Software fault avoidance
12.4.3 Software fault tolerance
13 Remark on “Confidence in the use of software tools”
14 Guidance on safety-related special characteristics
14.1 General
14.2 Identification of safety-related special characteristics
14.3 Specification of the control measures of safety-related special characteristics
14.4 Monitoring of the safety-related special characteristics
Annex A (informative) Fault tree construction and applications
Bibliography