Glossary

Safety vocabulary used in Project C, with pointers into ISO 26262:2018. Definitions here are paraphrased; the standard’s own wording is in the cited entries of ISO 26262-1:2018 (the vocabulary part).

ISO 26262 terms

• ASIL, automotive safety integrity level (26262-1, 3.6): one of four levels, A through D, D the most demanding, that scales the rigor required of an element; assigned per hazardous event by the HARA.
• HARA, hazard analysis and risk assessment (26262-1, 3.76; method in 26262-3, Clause 6): the analysis that classifies each hazardous event by severity, exposure, and controllability and derives an ASIL and a safety goal from them.
• S, E, C: the three HARA classification axes: severity of harm, probability of exposure to the situation, and controllability by the people involved (26262-3, Tables 1, 2, and 3; ASIL determination in Table 4).
• Safety goal (26262-1, 3.139): the top-level safety requirement for a hazardous event; everything below it refines this.
• Safety mechanism (26262-1, 3.142): a technical measure that detects or controls faults to keep the item in a safe state; our monitor element is one.
• ASIL decomposition (26262-1, 3.3; method in 26262-9, Clause 5): splitting a safety requirement into redundant requirements on sufficiently independent elements, using the schemas of 26262-9, 5.4.9.
• X(Y) notation, as in QM(D) or B(D): the element is developed at level X, while the parenthesized Y records the ASIL of the original requirement before decomposition, because some obligations still follow the original.
• QM, quality management: no ASIL assigned; the element is handled by normal quality processes rather than the safety lifecycle.
• Confirmation review (26262-2, 6.4.7 and Table 1): a review of a key safety work product by someone with a required degree of independence from its authors.
• Dependent failures (analysis per 26262-9, Clause 7): failures of supposedly independent elements that aren’t independent in fact, from shared causes (power, clock, housing, update train) or cascades; the analysis that an ASIL decomposition’s independence claim rests on.
• TCL, tool confidence level (26262-8, Clause 11): the outcome of evaluating a software tool: whether its possible malfunctions matter and whether they would be detected, which determines if the tool needs qualification (26262-8, 11.4.5 and 11.4.6).

Domain terms

• FCW, forward collision warning: the vehicle function guardian arbitrates for.
• TTC, time to collision: range divided by closing speed, the quantity the arbiter thresholds.
• EMA, exponential moving average: the smoothing filter in the reference decision channel.
• Channel: one of the redundant sensing-and-decision paths in the decomposed architecture; this workshop’s exercise builds the radar channel, with the camera channel specified on paper.