Skip to content

Improvement: Safety Analysis for ML 2 #408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masc2023 merged 2 commits into from
Nov 25, 2025
Merged

Improvement: Safety Analysis for ML 2 #408

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff2cf66
update process descriptions
PandaeDo Nov 24, 2025
63c5c68
update process req status
PandaeDo Nov 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions process/process_areas/safety_analysis/guidance/safety_analysis_checklist.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Safety Analysis Checklist
:tags: safety_analysis

**Purpose**
The purpose of this safety analysis (DFA and FMEA) checklist template is to collect the topics to be checked during verification of the safety analysis.
The purpose of this Safety Analysis (DFA and FMEA) checklist template is to collect the topics to be checked during verification of the Safety Analysis.

**Checklist**

Expand Down Expand Up @@ -73,8 +73,8 @@ Safety Analysis Checklist
- <yes|no>
-
* - REQ_01_08
- Is the overall result of the safety analysis described in the report?
- It shall be shown in the report if the safety analysis are finished and if all artifacts are "valid" and "sufficient".
- The results of the safety analysis are described in the report. The report is available :need:`wp__verification_platform_ver_report`.
- Is the overall result of the Safety Analysis described in the report?
- It shall be shown in the report if the Safety Analysis are finished and if all artifacts are "valid" and "sufficient".
- The results of the Safety Analysis are described in the report. The report is available :need:`wp__verification_platform_ver_report`.
- <yes|no>
-
8 changes: 4 additions & 4 deletions process/process_areas/safety_analysis/guidance/safety_analysis_guideline.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,12 @@ Safety Analysis Guidelines
:complies: std_req__iso26262__analysis_841, std_req__iso26262__analysis_842, std_req__iso26262__analysis_843, std_req__iso26262__analysis_844, std_req__iso26262__analysis_847, std_req__iso26262__analysis_848, std_req__iso26262__analysis_849, std_req__iso26262__analysis_8410, std_req__isopas8926__44431, std_req__isopas8926__44432

This document describes the general guidances for Safety Analysis (DFA and FMEA) based on the concept which is defined :need:`Safety Analysis Concept<doc_concept__safety_analysis>`.
Use the platform DFA as an input so that general safety mechanisms are only defined once and not in every single safety analysis.
Use the Platform DFA as an input so that general Safety Mechanisms are only defined once and not in every single Safety Analysis.

Workflow for Safety Analysis
============================

The workflow of the safety analysis are described in :ref:`workflow_safety_analysis`. The single steps in these workflows are described in detail in the following sections.
The workflow of the Safety Analysis are described in :ref:`workflow_safety_analysis`. The single steps in these workflows are described in detail in the following sections.


Step-by-Step-approach FMEA:
Expand Down Expand Up @@ -57,7 +57,7 @@ The attributes of the template are described in :ref:`process_requirements_safet
#. Continue the analysis until all applicable fault models are checked.
#. The verification is done by applying the checklist :need:`gd_chklst__safety_analysis`.

.. note:: If there are changes they have to be analysed with a impact analysis :need:`gd_temp__change_impact_analysis`. If needed the safety analysis (DFA or FMEA) has to be updated accordingly. Therefore all necessary steps have to be repeated.
.. note:: If there are changes they have to be analysed with a impact analysis :need:`gd_temp__change_impact_analysis`. If needed the Safety Analysis (DFA or FMEA) has to be updated accordingly. Therefore all necessary steps have to be repeated.


Step-by-Step-approach DFA:
Expand Down Expand Up @@ -86,7 +86,7 @@ The attributes of the template are described in :ref:`process_requirements_safet
#. Continue the analysis until all applicable failure initiators are checked.
#. The verification is done by applying the checklist :need:`gd_chklst__safety_analysis`.

.. note:: If there are changes they have to be analysed with a impact analysis :need:`gd_temp__change_impact_analysis`. If needed the safety analysis (DFA or FMEA) has to be updated accordingly. Therefore all necessary steps have to be repeated.
.. note:: If there are changes they have to be analysed with a impact analysis :need:`gd_temp__change_impact_analysis`. If needed the Safety Analysis (DFA or FMEA) has to be updated accordingly. Therefore all necessary steps have to be repeated.

.. _examples_fmea_dfa:

Expand Down
38 changes: 19 additions & 19 deletions process/process_areas/safety_analysis/guidance/safety_analysis_process_reqs.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
Safety Analysis Process Requirements
====================================

.. note:: Safety analysis is used as a umbrella term for the methods DFA (Dependent Failure Analysis) and FMEA (Failure Mode and Effects Analysis).
.. note:: Safety Analysis is used as a umbrella term for the methods DFA (Dependent Failure Analysis) and FMEA (Failure Mode and Effects Analysis).

.. gd_req:: Safety Analysis Structure
:id: gd_req__saf_structure
Expand Down Expand Up @@ -48,16 +48,16 @@ Process Safety Analysis Attributes

Each Safety Analysis shall have a unique ID. It shall be in a format which is also human readable and consists of

* type of Safety Analysis (DFA or FMEA)
* name of analysed structural element (e.g. Persistency, FEO, etc.)
* element descriptor (e.g. KVS__Open KVS or KVS__GetKeyValue)
* Type of Safety Analysis (DFA or FMEA)
* Name of analysed structural element (e.g. Persistency, FEO, etc.)
* Element descriptor (e.g. KVS__Open KVS or KVS__GetKeyValue)

The naming convention shall be defined in the project and shall be used consistently.

.. gd_req:: Safety Analysis attribute: title
:id: gd_req__saf_attr_title
:status: valid
:tags: manual_prio_1, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__support_6424

Expand All @@ -66,7 +66,7 @@ Process Safety Analysis Attributes
.. gd_req:: Safety Analysis attribute: mitigated by
:id: gd_req__saf_attr_mitigated_by
:status: valid
:tags: prio_1_automation, attribute, optional
:tags: done_automation, attribute, optional
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_844, std_req__iso26262__analysis_746, std_req__iso26262__analysis_747

Expand All @@ -77,7 +77,7 @@ Process Safety Analysis Attributes
.. gd_req:: Safety Analysis attribute: mitigation issue
:id: gd_req__saf_attr_mitigation_issue
:status: valid
:tags: prio_1_automation, attribute, optional
:tags: done_automation, attribute, optional
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_844, std_req__iso26262__analysis_746, std_req__iso26262__analysis_747

Expand All @@ -86,7 +86,7 @@ Process Safety Analysis Attributes
.. gd_req:: Safety Analysis attribute: sufficient
:id: gd_req__saf_attr_sufficient
:status: valid
:tags: prio_1_automation, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_848, std_req__iso26262__analysis_749, std_req__isopas8926__44431, std_req__isopas8926__44432

Expand All @@ -96,7 +96,7 @@ Process Safety Analysis Attributes
.. gd_req:: Safety Analysis content: argument
:id: gd_req__saf_argument
:status: valid
:tags: prio_1_automation, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_848, std_req__iso26262__analysis_749, std_req__isopas8926__44433

Expand All @@ -106,16 +106,16 @@ Process Safety Analysis Attributes
.. gd_req:: Safety Analysis attribute: status
:id: gd_req__saf_attr_status
:status: valid
:tags: prio_1_automation, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_848, std_req__iso26262__analysis_749, std_req__isopas8926__44431, std_req__isopas8926__44432

Each safety analysis shall have the status invalid until the analysis is finished. The status shall be set to valid if the analysis is finished and all issues are closed.
Each Safety Analysis shall have the status invalid until the analysis is finished. The status shall be set to valid if the analysis is finished and all issues are closed.

.. gd_req:: Safety Analysis attribute: failure effect
:id: gd_req__saf_attr_feffect
:status: valid
:tags: prio_1_automation, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_742

Expand All @@ -129,7 +129,7 @@ Safety Analysis Linkage
.. gd_req:: Safety Analysis Linkage check
:id: gd_req__saf_linkage_check
:status: valid
:tags: prio_1_automation, attribute, automated
:tags: done_automation, attribute, automated
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_842, std_req__iso26262__software_7410, std_req__iso26262__software_7411

Expand All @@ -147,7 +147,7 @@ Safety Analysis Linkage
.. gd_req:: Safety Analysis attribute: check Requirements linkage
:id: gd_req__saf_attr_requirements_check
:status: valid
:tags: prio_1_automation, attribute, automated
:tags: done_automation, attribute, automated
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_842, std_req__iso26262__software_7410, std_req__iso26262__software_7411

Expand All @@ -165,7 +165,7 @@ Safety Analysis Linkage
.. gd_req:: Safety Analysis attribute: link to Aou
:id: gd_req__saf_attr_aou
:status: valid
:tags: prio_1_automation, attribute, automated
:tags: done_automation, attribute, automated
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_845

Expand All @@ -187,7 +187,7 @@ Safety Analysis Linkage
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_842, std_req__iso26262__software_7410, std_req__iso26262__software_7411

It shall be checked that safety analysis can only be linked against valid safety elements (architecture view, requirement, AoU). A valid safety element has the attribute 'status == valid' and safety != QM.
It shall be checked that Safety Analysis can only be linked against valid safety elements (architecture view, requirement, AoU). A valid safety element has the attribute 'status == valid' and safety != QM.

.. _process_requirements_safety_analysis_checks:

Expand All @@ -197,7 +197,7 @@ Safety Analysis Checks
.. gd_req:: Safety Analysis mandatory attributes provided
:id: gd_req__saf_attr_mandatory
:status: valid
:tags: prio_1_automation, attribute, check
:tags: done_automation, attribute, check
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_848, std_req__iso26262__analysis_749

Expand Down Expand Up @@ -237,7 +237,7 @@ DFA Process Requirements
.. gd_req:: DFA attribute: failure ID
:id: gd_req__saf_attr_failure_id
:status: valid
:tags: prio_1_automation, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_platform_featarch, wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__support_6425, std_req__iso26262__support_6432

Expand All @@ -251,7 +251,7 @@ FMEA Process Requirements
.. gd_req:: FMEA attribute: fault ID
:id: gd_req__saf_attr_fault_id
:status: valid
:tags: prio_1_automation, attribute, mandatory
:tags: done_automation, attribute, mandatory
:satisfies: wf__analyse_featarch, wf__analyse_comparch
:complies: std_req__iso26262__analysis_848

Expand Down
10 changes: 5 additions & 5 deletions process/process_areas/safety_analysis/safety_analysis_concept.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,11 @@ Concept Description
:status: valid
:tags: safety_analysis

This section discusses a concept for safety analysis. As methods for safety analysis are used DFA (Dependent Failure Analysis)
This section discusses a concept for Safety Analysis. As methods for Safety Analysis are used DFA (Dependent Failure Analysis)
and FMEA (Failure Mode and Effects Analysis). Inputs for this concept are the requirements of ISO26262 Part 6 Chapter 7 and Part 9 Chapter 7 and 8.

The objective of the **DFA** is to show the absence of dependent failures. Dependent failures are split into common cause failures and cascading failures.
How to perform a safety analysis is described in :need:`gd_guidl__safety_analysis`.
How to perform a Safety Analysis is described in :need:`gd_guidl__safety_analysis`.
To have a structured DFA the failure initiators have to be applied :need:`gd_guidl__dfa_failure_initiators`. These are separated into the following categories:

| - Shared resources: Shared resources are resources that are used by two or more elements. If one element fails, it could lead to a failure in another element.
Expand All @@ -45,7 +45,7 @@ In this case please document this in the content of the document.
Inputs
******

#. Stakeholders for the safety analysis (DFA and FMEA)?
#. Stakeholders for the Safety Analysis (DFA and FMEA)?
#. Who needs which information?
#. How to analyse existing safety mitigation?
#. How to add new safety mitigations?
Expand Down Expand Up @@ -94,7 +94,7 @@ Also requirements of standards need to be taken into consideration:
How to analyse?
===============

The safety analysis (DFA and FMEA) are done on the feature and component architecture. The safety analysis (DFA and FMEA) shall be done accompanying to the development.
The Safety Analysis are done on the platform (DFA only), feature and component architecture. The Safety Analysis (DFA and FMEA) shall be done accompanying to the development.
So the results can directly be used for the development of the feature and component. With a iterative approach it is needed to proof
the evidence of the functional safety of the functions.

Expand Down Expand Up @@ -140,7 +140,7 @@ additional safety mitigation is needed.
What analysis shall be done in which level?
===========================================

The safety analysis (DFA and FMEA) shall consider the architectural elements on different levels.
The Safety Analysis (DFA and FMEA) shall consider the architectural elements on different levels.

1. **Platform Level**: At this level, the focus is on the overall feature architecture to analyse if there are failures that effects more than one feature.

Expand Down
12 changes: 6 additions & 6 deletions process/process_areas/safety_analysis/safety_analysis_getstrt.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,20 +21,20 @@ Getting Started
:tags: safety_analysis


This document outlines the steps for performing, monitoring, and verifying safety analysis. Safety analysis is used as a umbrella term for the methods
This document outlines the steps for performing, monitoring, and verifying Safety Analysis. Safety Analysis is used as a umbrella term for the methods
DFA (Dependent Failure Analysis) and FMEA (Failure Mode and Effects Analysis).
The concept of performing safety analysis is described in :need:`doc_concept__safety_analysis`. The verification of the architecture is described
The concept of performing Safety Analysis is described in :need:`doc_concept__safety_analysis`. The verification of the architecture is described
in :need:`doc_concept__arch_process`.

Safety Analysis Steps
*********************

The goal of the safety analysis is to proof that the safety requirements for functions and safety mechanisms are not violated.
The safety analysis is performed in three steps.
The goal of the Safety Analysis is to proof that the safety requirements for functions and safety mechanisms are not violated.
The Safety Analysis is performed in three steps.

* Analyse the architecture with a DFA and FMEA.
* Monitor the DFA and FMEA and log any issues in the Issue Tracking system with the ``safety`` label until the analysis is completed.
* Verify the FMEA and DFA results by using :need:`gd_chklst__safety_analysis`. The safety analysis are completed when the verification is done, no issues are open and the status is “valid”.
* Verify the FMEA and DFA results by using :need:`gd_chklst__safety_analysis`. The Safety Analysis are completed when the verification is done, no issues are open and the status is “valid”.

The details of what needs to be done in each step are described in the :need:`gd_guidl__safety_analysis`. For the safety analysis
The details of what needs to be done in each step are described in the :need:`gd_guidl__safety_analysis`. For the Safety Analysis
templates are used. The templates are described in the :ref:`FMEA_templates` and :ref:`DFA_templates`.
16 changes: 8 additions & 8 deletions process/process_areas/safety_analysis/safety_analysis_roles.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@ Roles
:status: valid
:contains: rl__committer

The safety engineer is responsible for the safety analysis (FMEA and DFA) in the project. There might be several analysis
The Safety Engineer is responsible for the Safety Analysis (FMEA and DFA) in the project. There might be several analysis
on different levels (e.g., Platform DFA, Feature and Component FMEA/DFA).

Required skills

* Degree: Master's degree in electrical engineering/computer science/mathematics, or similar degree, or comparable work experience
* Deep understanding of functional safety engineering including safety analysis (e.g., FMEA, DFA)
* Knowledge of safety management to ensure collaboration with the Safety Manager
* Degree: Master's degree in Electrical Engineering/Computer Science/Mathematics, or similar degree, or comparable work experience
* Deep understanding of functional Safety Engineering including Safety Analysis (e.g., FMEA, DFA)
* Knowledge of Safety Management to ensure collaboration with the Safety Manager
* Technical know-how of embedded systems
* Preferred training: Automotive Functional Safety Expert (AFSE) or similar

Expand All @@ -38,14 +38,14 @@ Roles

Experience

* More than five years of experience in safety engineering
* Experience safety analysis methods (e.g., FMEA, DFA)
* More than five years of experience in Safety Engineering
* Experience Safety Analysis methods (e.g., FMEA, DFA)
* Experience in automotive software development projects
* Experience in creation of workproducts according ISO 26262

Responsibility

* Analyse Feature and Component Architecture by performing FMEA and DFA
* Analyse Platform, Feature and Component Architecture by performing FMEA and DFA
* Monitor Safety Analyses and DFA
* Verify Safety Analyses and DFA
* Create the Safety Manual
Expand All @@ -62,6 +62,6 @@ Contributing Roles:
* :need:`Safety Manager <rl__safety_manager>`
* :need:`Security Manager <rl__security_manager>`

A detailed overview of the responsibility for the steps of the safety analysis process is listed in the section titled "Workflow for safety analysis". You can find it here:
A detailed overview of the responsibility for the steps of the Safety Analysis process is listed in the section titled "Workflow for Safety Analysis". You can find it here:

:ref:`workflow_safety_analysis`
4 changes: 2 additions & 2 deletions process/process_areas/safety_analysis/safety_analysis_workflow.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
Workflow Safety Analysis
########################

Safety analysis is used as a umbrella term for the methods FMEA (Failure Modes and Effects Analysis) and DFA (Dependent Failure Analysis).
Safety Analysis is used as a umbrella term for the methods FMEA (Failure Modes and Effects Analysis) and DFA (Dependent Failure Analysis).

.. workflow:: Analyze Platform Feature Architecture
:id: wf__analyse_platform_featarch
Expand All @@ -32,7 +32,7 @@ Safety analysis is used as a umbrella term for the methods FMEA (Failure Modes a
:contains: gd_guidl__dfa_failure_initiators, gd_temp__plat_saf_dfa
:has: doc_concept__safety_analysis, doc_getstrt__safety_analysis

| With a platform DFA the potential common usage of modules shall be analysed. It shall be used as an input for all other DFA's.
| With a platform DFA the potential common usage of features shall be analysed. It shall be used as an input for all other DFA's.
| There will be only one platform DFA.

.. workflow:: Analyse Feature Architecture
Expand Down
Loading
Loading