功能安全软件架构与安全分析汽车电子咖啡厅.doc

Automotive Functional Safety 汽车功能安全 TüV Rheinland Industrial Services 李泽华 1 1 Safety Service 汽车功能安全3大业务范围 功能安全 ? 培训及人员资质认证 ? 流程及项目技术咨询 ? 功能安全评估及认证 安全 ? 培训 ? 项目支持 ? 产品认证 信息安全 ASPICE ? 审核员培训 ? 指导流程搭建 ? 指导流程改进 ? ASPICE认证 2 Software architecture design Objective of this Lecture 1. Reasonable classification of function groups 2. Reasonable distribution of function blocks 3. Figure out different ASIL level function blocks 4. Consider ISO26262 requirements at software architecture level 5. Work out safety mechanism at software architecture level Lecture Agenda ● Software Architecture Introduction ● Software Architecture requirements from ISO26262 ● Data flow analysis and Control flow analysis ● Safety Critical Analysis(SCA) ● ASIL Decomposition ● Coexistence of Software Components ● Interference between Software Components ● Dependent Failure Analysis ● Software Safety Analysis ● Mechanism for error detection and handling at Software architecture Level ● Verification of the software architectural design What’s Software architecture? Static aspect Dynamic aspect Current Problems in Automotive Domain No SW architecture ? No base for software safety analysis ? No base for software change impact analysis Incomplete Interface ? Wrong ASIL decomposition, e.g. ASIL-SWC receive the safety related input data from QM-SWC ? Wrong freedom of interference Rough Architecture ? All SWC are ASIL x, over-design, over engineering. ? Tips: balance your efforts on SW architecture phase and SW unit phase 7 Notations for Software architecture ?ISO 26262-8, table 1 Methods ASIL A ASIL B ASIL C ASIL D 1a Informal notations ++ ++ + + Figure 1b Semi-formal notations + ++ ++ ++ ? 该方法有完整语法定义，但是语义定义不完整 UML class diagram Principles for software architecture design Methods ASIL A B C D 1a Hierarchical structure of software components ++ ++ ++ ++ 1b Restricted size of software componentsa ++ ++ ++ ++ 1c Restricted size of interfacesa + + + + 1d High cohesion within each software componentb + ++ ++ ++ 1