GB/Z 42285-2022Road vehicles - ASIL determination guidelines for electrical and electronic system (English PDF)

Foreword

This document was drafted in accordance with the rules given in GB/T 1.1-2020, Directives for standardization - Part 1: Rules for the structure and drafting of standardizing documents.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The issuing body of this document shall not be held responsible for identifying any or all such patent rights.

This document was proposed by the Ministry of Industry and Information Technology of the People's Republic of China and is under the jurisdiction of the National Technical Committee of Auto Standardization (SAC/TC 114).

The drafting organizations of this document are: China Automotive Technology and Research Center Co., Ltd.; Pan Asia Technical Automotive Center Co., Ltd.; FAW Jiefang Automotive Co., Ltd.; Shanghai Hella Electronics Co., Ltd.; Bosch Automotive Products (Suzhou) Co., Ltd.; Beijing Horizon Robotics Technology Research and Development Co., Ltd.; Xingkedi Technology (Taizhou) Co., Ltd.; Schaeffler (China) Co., Ltd.; United Automotive Electronic Systems Co., Ltd.; Shenzhen DJI Innovation Technology Co., Ltd.; Beijing CHJ Automotive Technology Co., Ltd.; Beijing National New Energy Vehicle Technology Innovation Center Co., Ltd.; Midea Group (Shanghai) Co., Ltd.; SAIC Volkswagen Automotive Co., Ltd.; Valeo Interior Controls (Shenzhen) Co., Ltd.; Hitachi Astemo Automotive Electronics (Shanghai) Co., Ltd.; CRRC Times Electric Vehicle Co., Ltd.; Chongqing Changan Automobile Software Technology Co., Ltd.; BYD Auto Industry Co., Ltd.; Dongfeng Nissan Passenger Vehicle Company of Dongfeng Motor Co., Ltd.; China FAW Group Co., Ltd.; Shanghai NIO Automobile Co., Ltd.; Guangzhou Automobile Group Co., Ltd.; Geely Automobile Research Institute (Ningbo) Co., Ltd.

The main drafters of this document are Li Bo, Fu Yue, Shang Shiliang, Zhang Lijun, Yu Jianye, Tong Fei, Qu Yuanning, Yang Hu, Shi Xiaomi, Xue Jianbo, Ming Yue, Liu Hui, Wang Fangfang, Jiang Jun, Jiang Yun, Xu Zanzhen, Wang Shuangquan, Zhang Lemin, Chen Rui, Xu Huizhong, Li Yong, Zhou Hongwei, Xiong Zaihui, Ma Xiaolong, Yang Xuezhu, Zhang Weiqian, Chen Yong, Lu Ping and Ren Xianan.

1 Scope

This document provides a method for determining the ASIL (Automotive Safety Integrity Level) of electrical and electronic systems of road vehicles. Determination of the ASIL of electrical and electronic systems is required by GB/T 34590.3-2022.

This document is applicable to safety-related systems that include one or more electrical and/or electronic (E/E) systems and that are installed in series production road vehicles, excluding mopeds.

2 Normative references

The contents of the following documents, through normative references in this text, constitute indispensable provisions of this document. For dated references, only the edition cited applies. For undated references, the latest edition (including any amendments) applies.

GB/T 34590 (all parts), Road vehicles - Functional safety.

GB/T 34590.1-2022, Road vehicles - Functional safety - Part 1: Vocabulary (ISO 26262-1:2018, MOD).

GB/T 34590.3-2022, Road vehicles - Functional safety - Part 3: Concept phase (ISO 26262-3:2018, MOD).

3 Terms and definitions

For the purposes of this document, the terms and definitions given in GB/T 34590.1-2022 apply.

4 Hazard analysis and risk assessment

4.1 Identification of hazards. Hazard analysis and risk assessment (HARA) is an analytical process that identifies potential hazards, combines them with operational situations to form a set of specific hazardous events, and assesses the risk of each hazardous event in order to determine its ASIL and safety goal. The item definition is a prerequisite for performing the HARA. Hazards can be identified by different hazard analysis techniques; this document gives examples of hazard identification using the hazard and operability study (HAZOP) technique. HAZOP is an exploratory method that can be used to identify and evaluate malfunctioning behaviours of the item and helps to examine, in a structured and systematic way, the operation of the item at vehicle level. It assumes different malfunctioning behaviours by applying suitable guidewords to each function of the item; such a malfunctioning behaviour can lead to a hazard that may cause potential harm to the occupants of the subject vehicle, to other vehicles and their occupants, or to other persons at risk such as pedestrians, cyclists or maintenance personnel in the vicinity of the vehicle.

Other valid methods can also be used to identify hazards; this document neither recommends nor endorses any specific hazard identification method, and hazard identification is part of the HARA. Annex A describes the motion behaviour of the vehicle along its different axes. As a simple example of HAZOP, based on the functions described in the item definition and considering the role and capability of the item's actuators, the following malfunctioning behaviours can be assumed: a) loss of function - function not provided when demanded; b) incorrect function when demanded: 1) more than intended, 2) less than intended, 3) in the opposite direction; c) unintended function - function provided when not demanded; d) output stuck at a fixed value - function cannot be updated as intended.

Note 1: when the item malfunctions, harm to maintenance personnel carrying out tasks unrelated to the maintenance of the item may be considered; however, harm to maintenance personnel caused by an existing fault of an item that is already faulty, damaged or disassembled for repair is not considered in the HARA. For example, an electric power steering system has a safety mechanism that switches off assist in the event of an assist-oscillation fault; when repairing this fault the technician may force the assist on to find its cause, which is a deliberate action for maintenance and cannot be analysed with the HARA method. Note 2: according to GB/T 34590 (all parts), the HARA is based on the malfunctioning behaviour of the item. Note 3: not all HAZOP guidewords apply to every analysis; they are tailored to the scope and content of the analysis, and the user can select a specific set of guidewords.

Table 1 gives an example of HAZOP applied to two vehicle functions. Steering assist: loss of assist; excessive assist (more than intended); insufficient assist (less than intended); reversed assist (opposite direction); unintended assist; steering lock (output stuck at a fixed value or position). Brake control (conventional braking): loss of braking force; excessive braking force; insufficient braking force; opposite direction not applicable; unintended braking; brake lock (output stuck at a fixed value or position). Note 4: interactions between different vehicle functions are analysed during the safety concept design of the item or in later confirmation; for example, loss of function of the item considered alone may be a degraded mode, but may not be a safe state at vehicle level once interactions and dependencies between items are considered.

Once the potential malfunctioning behaviours of a function have been assumed, the hazard analysis continues by analysing the vehicle-level hazards produced by each malfunctioning behaviour, considering the operational situations of the vehicle including all phases of the item life cycle (e.g. operation, service and decommissioning). The same malfunctioning behaviour can cause several vehicle-level hazards depending on the vehicle behaviour in different operational situations; for example, unintended or excessive braking can cause unintended deceleration and unintended lateral motion depending on the driving situation. Conversely, different malfunctioning behaviours can lead to the same vehicle-level hazard. HARA is iterative: malfunctioning behaviours and the corresponding vehicle-level hazards are continually updated as different operational situations and life-cycle phases are considered.

Tables 2 and 3 give examples of mapping the malfunctioning behaviours of Table 1 to vehicle-level hazards; the mapping differs with the driving scenario considered (e.g. loss of braking leads to loss of deceleration capability and the vehicle rolling away on a slope). Table 2 (steering assist): unintended assist, excessive assist and reversed assist lead to unintended lateral vehicle motion / unintended yaw; steering lock leads to loss of lateral motion control; insufficient assist and loss of assist lead to heavy steering (increased steering effort). Table 3 (brake control): unintended braking, excessive braking force and brake lock lead to unintended vehicle deceleration and also to unintended lateral vehicle motion; loss of braking force and insufficient braking force lead to unintended reduction of deceleration capability.

4.2 Risk assessment. 4.2.1 General. During risk assessment it is assumed that a malfunctioning behaviour of the item causes one or more hazards. Whether a hazard, as a potential source of harm, leads to harm depends strongly on the driving situation in which the malfunction occurs. The first step is therefore to assume a vehicle driving or operational situation for defining the harm; the exposure (E) of that situation is determined following 4.2.2, and severity (S) and controllability (C) of the hazardous event following 4.2.3 and 4.2.4. The process is repeated for each reasonably foreseeable operational situation of the vehicle containing the item. The result depends on the availability of item, vehicle and data information; the design of the item functions and the vehicle characteristics influence the definition of the harmful scenarios and the E, S and C classes and their rationale, and the analyst should consider these factors when analysing the system under development. For every analysed hazardous event, the highest ASIL and the rationale for the assigned E, S and C should be recorded (e.g. in a HARA template). Note: the order of determining E, S and C can be changed; this document assumes the order of Figure 1.

Figure 1 shows the risk assessment process as four sequential steps starting from the vehicle-level hazard: step 1 determine exposure, step 2 determine severity, step 3 determine controllability, step 4 determine the ASIL.

4.2.2 Step 1: Determining exposure. 4.2.2.1 General information. According to GB/T 34590.3-2022, the exposure of an operational situation can be assigned to one of the five classes of Table 4, which summarises Table 2 and the examples of B.2 and B.3 of Annex B of GB/T 34590.3-2022, giving exposure classes based on the frequency and on the duration of the situation. The first step of risk assessment (Figure 1) is to evaluate exposure for a specific operational situation, which may consist of several conditions occurring simultaneously. The purpose is to understand real situations, including normal and hazardous driving conditions; differing traffic rules and environmental conditions influence the situations considered and can lead to different exposure values.

Table 4 (exposure classes): E0 incredible - not defined for frequency or duration (no ASIL assigned for E0); E1 very low probability - occurs less often than once a year for the great majority of drivers (duration: not defined); E2 low probability - occurs a few times a year for the great majority of drivers, or less than 1 % of average operating time; E3 medium probability - occurs once a month or more often for an average driver, or 1 % to 10 % of average operating time; E4 high probability - occurs during almost every drive on average, or more than 10 % of average operating time. Frequency criteria refer to Table B.3 and duration criteria to Table B.2 of GB/T 34590.3-2022.

4.2.2.2 Exposure based on duration. Where a malfunctioning behaviour directly leads to the hazardous event, an exposure class based on the duration of the operational situation can be selected. Example: an electric power steering system applies an incorrect steering torque; with the vehicle stationary the effect on the driver may be small, but on a motorway the driver is very likely to leave the intended lane; since motorway driving lasts more than 10 % of total operating time, motorway driving can be classed E4. Note: the likelihood that a hazard results in potential harm increases or decreases depending on the behaviour of the persons at risk or the environment of the hazardous event.

4.2.2.3 Exposure based on frequency. The exposure class can be determined not only by operational situations in which the malfunction directly causes the hazardous event (related to duration), but also by situations in which a fault that occurred earlier and remained latent in the system triggers the hazardous event; the occurrence of the situation combined with the pre-existing fault directly triggers the event, without considering its duration. Example: for activation of the rear reversing lamp, a frequency-based exposure can be chosen; the situation 'vehicle reversing' occurs often and is classed E4. Frequency is used because, whenever the reversing lamp fails, the hazard can only be triggered when the vehicle is shifted into reverse.

4.2.2.4 Vehicle operational situations. Figure 2 lists vehicle operational situations for reference; the list is not exhaustive and situations can often be merged to reduce or simplify those considered in the HARA (see 6.4.2 of GB/T 34590.3-2022). Figure 2 groups them as: location (motorway, country road, urban road, intersection, muddy road, off-road, parking lot, road, service station); road conditions (friction - dry, ice, snow, wet, different adhesion coefficients - slope, road width); driving manoeuvre (starting, stopping, forward, reversing, straight, turning, yielding lane, lane change, switching off); vehicle state (cruising, crawling, accelerating, decelerating, parked, stopped, collision); other considerations (crosswind, oncoming traffic, construction zone, accident scene, traffic jam, pedestrians); other vehicle characteristics (state of other vehicle systems, fault codes, towing, heavy load, engine off/ignition on, remote vehicle start, presence of other technologies).

4.2.2.5 Guidance on assigning exposure. The following can be considered: a) exposure assignment is derived by expert judgement from applicable and available data and information on traffic, culture, road conditions and driving style for different geographic locations or target markets; where in doubt, estimates can be used. b) Either the frequency of exposure to the situation or the probability of exposure to its overall duration can be considered; where both criteria apply, each should be evaluated separately (example: for 'car wash', frequency gives E3 and duration gives E2). c) Exposure can be evaluated by considering situations occurring in actual use of the vehicle and, where applicable, the exposure in a specific target market; this should not be used to artificially raise or lower exposure. d) The examples of operational situations in GB/T 34590.3-2022 can be used as reference. e) Several factors may have to combine for the hazard to lead to a specific harm, and some of them may be closely correlated; the correct exposure of a combination of preconditions can only be calculated after identifying their interdependence. Example: snow and ice are highly correlated with reduced road friction; if snow and ice are each treated as independent E2 factors, combining them does not yield an exposure lower than E2 for the snow-and-ice situation, and treating correlated situations as independent can lead to inappropriate downgrading of exposure.

f) The HARA does not consider hazards to maintenance personnel that are covered by workplace safety regulations, nor hazards caused by an item under repair (see Note 1 of 4.1). g) Defined hazardous events should be specific enough to allow correct determination of severity and controllability: a situation can be split into several additional specific situations (possibly giving different S and C parameters); if the results for several situations related to the same hazard are similar or identical, those situations should be combined for analysis; the guidance above should not be used to artificially raise or lower exposure factors; it is not required to examine exhaustively every possible combination - it is sufficient to consider typical operational situations including those that lead to the highest ASIL.

4.2.3 Step 2: Determining severity. 4.2.3.1 General information. According to GB/T 34590 (all parts), the severity of the potential harm caused by a specific hazardous event can be classified into one of the four levels of Table 5; these levels are a general classification that guides the ASIL assignment of a given hazardous event. Severity is usually difficult to define precisely because the outcome of any real collision depends on many factors, many of which cannot be determined in advance, including: a) collision type, e.g. planar collisions (frontal, rear, side); b) relative speed between the vehicles involved, or of a single vehicle and the object struck; c) relative size, height and structural integrity of the vehicles (crash compatibility); d) health and age of occupants and of persons at risk outside the vehicle; e) use of protective devices by occupants (e.g. seat belts, child restraints); f) availability and response of qualified, rapid emergency rescue.

Some collision characteristics, and in some cases the relative speed, can be predicted from these factors; most other factors affecting the severity of harm from an assumed hazardous event cannot reasonably be predicted in advance, and the factors above can partly serve for determining exposure and controllability. Apart from negligible collisions, the likelihood of injury, including fatal injury, is almost never zero. Injury susceptibility varies greatly between road users (e.g. pedestrians, cyclists): young healthy persons can withstand larger forces without lasting serious injury, whereas elderly or frail persons may suffer serious injury even in minor low-speed collisions; the severity outcome of almost any collision type is therefore a distribution from 'almost no injury' to 'life-threatening'. Table 5 (severity classes per GB/T 34590.3-2022): S0 no injuries (no ASIL assigned); S1 light and moderate injuries; S2 severe and life-threatening injuries (survival probable); S3 life-threatening injuries (survival uncertain), fatal injuries; examples of classification are in Table B.1 of GB/T 34590.3-2022.

Severity is assigned to a given hazardous event on the basis of representative hazardous scenarios; developing such an assumed scenario draws on several information sources, including but not limited to expert analysis and judgement and analysis of technical reports, in particular of relevant accidents or tests, simulations and historical accident data. Annex B gives general information that can be used to assign an appropriate severity to a given vehicle-level motion control hazard.

4.2.3.2 Guidance on assigning severity for collision-related hazards. Assigning severity in the HARA requires expert judgement considering representative samples of traffic situations, vehicle speeds and road conditions. Because active and passive safety technologies keep advancing and education and enforcement of safe road-user behaviour are strengthened, analysis of historical accident data tends to overestimate future injury risk and may not contain suitable data for a new, different scenario; models can then be used to add new scenarios to the historical data. In general injury risk increases with collision speed; for planar collisions, estimates of the change in velocity (delta-v) available in some accident databases can support severity assessment, and other estimates (e.g. energy equivalent speed, relative speed between vehicle and object) plus other characteristics such as overlap and intrusion can be used. Annex B gives general guidance. For non-planar collisions such as rollover, other criteria depending on the hazardous scenario can be used; examples in GB/T 34590.3-2022 can also serve as reference.

When determining possible severity from historical data, the available data relevant to the system under development should be analysed: for instance, new active safety features that automatically intervene in vehicle dynamics in imminent-collision situations shift the balance between driver and vehicle control, so present data may not reflect the correct result once new functions are applied. The vehicle or system manufacturer should analyse all technologies applied to the specific vehicle when determining severity and ASIL. The severity of hazardous events in the representative scenarios considered is recorded in the HARA documentation. Note 1: exposure is considered together with the associated severity; if a higher severity than that shown by traffic data for a driving condition is chosen, exposure is evaluated for the condition corresponding to that higher severity. Note 2: historical accident data do not necessarily predict injury outcomes of future accident types; as vehicles, roads and road-user behaviour evolve towards greater safety, historical data tend to overestimate future risk and severity, so simply applying historical data to predict the harm and severity of a specific vehicle-level hazard is not recommended.

4.2.4 Step 3: Determining controllability. 4.2.4.1 General information. According to GB/T 34590.3-2022, the controllability of a hazardous event is one of the four classes of Table 6: C0 controllable in general - where dedicated regulations exist for a specific hazard, C0 can be assigned when this is consistent with existing experience on the adequacy of control (see 6.4.3.9 of GB/T 34590.3-2022; no ASIL assigned for C0); C1 simply controllable - more than 99 % of average drivers or other traffic participants are able to avoid harm; C2 normally controllable - 90 % to 99 % are able to avoid harm; C3 difficult to control or uncontrollable - less than 90 % are able to avoid harm. 'Specific hazard' is as in Note 2 of 6.4.3.8 of GB/T 34590.3-2022.

4.2.4.2 Guidance on assigning controllability. The controllability class can be determined using existing data, by tests in a simulator or vehicle, or by consulting a multidisciplinary expert team (e.g. human factors), and should be based on the target market (e.g. control capability of traffic participants, scenario factors). Annex B of GB/T 34590.3-2022 gives controllability examples that can be used as reference. Whenever an E/E system fault can provoke a reaction of the driver, the adverse effect of the hazard on the persons at risk should be considered (see 7.4.2.7 of GB/T 34590.3-2022); methods for evaluating this potential adverse effect are given in references [3] and [4]. Extended response times due to driver impairment (drugs, alcohol or lack of sleep) or to driver inattention or distraction are not within the scope of controllability (see Note 2 of 6.4.3.8 of GB/T 34590.3-2022). Reasonably foreseeable misuse should be considered where applicable to the specific analysis. Relevant environmental features (e.g. guard rails) and driver experience, behaviour and training can be taken into account; other on-board systems that mitigate the harm of the hazardous event can be considered in the HARA if they are sufficiently independent of the item. Optional safety or driver assistance systems (e.g. lane keeping assist) should not be regarded as risk-reducing measures when setting controllability for a specific vehicle platform.

4.2.5 Step 4: Determining the ASIL. 4.2.5.1 Determining the ASIL from S, E and C. In accordance with 6.4.3.10 of GB/T 34590.3-2022, the ASIL of each hazardous event is determined from the parameters severity, exposure and controllability, consistent with Table 4 of GB/T 34590.3-2022 (see Table 7). The ASIL determination is based on the relevant scenario, in which S, E and C are consistent. Note: if the ASIL result for a new system is inconsistent with hazard experience from similar existing systems with a long market history, the market and traffic data used to derive S, E and C for the new system may need to be re-examined, consistent with the iterative nature of the HARA process.

Table 7 (ASIL determination, columns C1/C2/C3): S1 - E1 QM/QM/QM, E2 QM/QM/QM, E3 QM/QM/A, E4 QM/A/B; S2 - E1 QM/QM/QM, E2 QM/QM/A, E3 QM/A/B, E4 A/B/C; S3 - E1 QM/QM/A, E2 QM/A/B, E3 A/B/C, E4 B/C/D.

When determining the ASIL of a new system, where applicable, the occurrence and severity of accidents caused by its malfunctioning behaviour can be compared with existing relevant accident data; the reaction of test subjects to the hazard can then be evaluated to derive a preliminary controllability class. Overestimating severity, exposure and controllability and the derived ASIL should be avoided, as it can reduce or even eliminate functions or features beneficial to overall vehicle safety; underestimating them should equally be avoided, as it can lead to insufficient safety requirements. Annex C gives a HARA example for electric power steering (EPS) assist; Annex D for propulsion and driveline functions; Annex E for suspension control functions; Annex F for braking and parking brake functions.

4.3 Relationship between safety goals and safe states. The output of the HARA is a set of safety goals to ensure safe operation, defined to avoid or mitigate the potential hazards caused by malfunctions of the item; controllability measures can be used in their definition. Safe states and associated safety measures are defined in the functional or technical safety concept to achieve the safety goals when the item fails. A HARA of the safe states is not always required, although the hazard of a safe state can be derived from the HARA when the safe state coincides with a specific failure at item level. Because safety goals and safe states originate from considering fault behaviour at different points in the safety life cycle, inconsistencies can arise; for consistency of the safety case it is recommended that safe states do not violate safety goals, which can be achieved by stating safety goals and safe states differently.

For example, a safety goal can be 'avoid loss of emergency braking without warning', while the safe state can be 'disable the function and inform the driver that it is unavailable'; the warning mitigates the consequences of loss of function because the driver knows the function is unavailable. The safety concept and the HARA should be consistent, otherwise the safety case is adversely affected. If the safe state for one safety goal violates another, less critical safety goal, care should be taken to keep their respective safety requirements consistent, and the rationale for this strategy should be provided.

Example: a system has a safety goal with a high ASIL to avoid a certain malfunction. In a previous project that system failure had been assigned a lower ASIL, so the functional safety engineer wrongly defined the failure as a 'safe state' in the concept phase. Later, in hardware design, when evaluating component failure risk with the single-point fault metric, it was found that the safety mechanism defined in the concept phase did not reduce risk but caused the system failure, i.e. the technical safety concept was self-contradictory. To resolve this, the 'safe state' or the failure mode needs to be redefined and the HARA repeated.

Annex A (informative) Vehicle-level motion

This annex briefly discusses possible vehicle-level motion along the different vehicle axes. Figure A.1 shows the six degrees of freedom of vehicle motion: the three straight arrows x, y and z represent longitudinal, lateral and vertical motion, and the rotations about these axes, p, q and r, are roll, pitch and yaw respectively. Unintended item behaviour can potentially affect vehicle motion along one or more axes.

Table A.1 provides guidance for systematic analysis of motion along (or about) the vehicle coordinate axes potentially caused by malfunctioning behaviour of the item; it applies to the HARA phase and allows the corresponding vehicle-level hazardous events to be derived for each potential hazard of the item. Longitudinal motion (along x): unintended acceleration; unintended loss of acceleration capability; unintended deceleration; unintended loss of deceleration capability; unintended longitudinal motion; unintended loss of longitudinal motion control; unintended reverse motion. Lateral motion (along y): unintended lateral motion; unintended loss of lateral motion control. Vertical motion (along z): unintended vertical motion. Pitch (rotation about y): unintended rotational motion about y. Roll (rotation about x): unintended rotational motion about x. Yaw (rotation about z): unintended rotational motion about z; unintended loss of rotational motion control about z.

Annex B (informative) Guidance on severity classification

B.1 General introduction. This annex contains general information on assigning severity classes to vehicle motion control hazards, which form part of the HARA; its content is not exhaustive or complete and should be applied with care. Severity assignment can draw on several sources, including (but not mandated or limited to) expert analysis and judgement, technical reports analysing specific relevant collisions or crash tests, simulation, or historical crash data. Crashes, laboratory tests, road tests and other test data provide objective, credible and repeatable results; simulation can indicate the relative contribution of the many factors and interactions typical of pre-crash scenarios and collision events; analysis of historical traffic accident data gives general guidance on accident frequency and injury probability for various scenarios, but has inherent limitations in precisely predicting the future.

For collision-based scenarios, GB/T 34590.3-2022 defines the concept of severity classes on the basis of injuries to persons in collisions (see Table B.1). It refers to the Abbreviated Injury Scale (AIS), which assigns a score of 0 to 6 to a single injury, and uses the probability of injury of specific AIS levels as evidence for assigning S0 to S3. Some historical accident databases give the AIS of injuries to some or all road users involved in traffic accidents within a defined geographic area; such data are usually small samples and case selection criteria vary by location. To use injury ratings from available accident databases properly, the inherent limitations of the data source should be analysed, and a good understanding of the collected data and its limitations is required to ensure a suitable method and proper interpretation of results.

Literature and analyses of real-world crash databases worldwide show that crash severity increases with relative speed; higher travel speeds can increase the likelihood of crashes at higher relative speeds and thus the likelihood of injury. However, the speed ranges defined for assigning S0 to S3 can vary widely depending on the accident data sources and specific crash selection criteria, due to regional differences in traffic environment, sampling criteria, or other factors such as crash attributes, crash configuration and fitment or use of occupant restraints.

Technical and practical considerations when using historical accident data from literature or specially developed analyses to support severity classification include: in-depth accident databases differ worldwide in case sampling criteria and collected data, and differences in results between databases may be partly due to sampling criteria; sample size should be considered to understand the uncertainty of the sampling process - in particular, the low frequency of crashes reaching the highest injury severity in existing in-depth databases may limit any injury rating and hence the support for severity assignment; selection of the sampled population (level of analysis) - for a given set of crashes, ratings based on the highest recorded injury may differ at crash, vehicle, road-user or vehicle-occupant level; according to Note 1 of 6.4.3.2 of GB/T 34590.3-2022, severity classification should consider the possible injuries to all participants involved.

Further considerations: much of the injury-related data collected after a crash is unknown before the crash and cannot be used in pre-crash scenarios, e.g. occupant characteristics (elderly occupants generally have higher injury risk than young occupants in similar crashes) and collision partner characteristics (a lightly loaded large commercial vehicle has a different crash energy potential from a fully loaded one); post-crash estimates of crash energy (e.g. relative speed, energy equivalent speed) are not necessarily calculated for every vehicle (e.g. no relative speed estimate may be available when the collision partner is a medium/heavy truck), do not necessarily correspond to the occupant crash pulse, which is influenced by crash characteristics, vehicle structure and interior, occupant size and restraint system, and do not necessarily match or even approximate the pre-crash travel speed.

If users have access to specific data or information for a particular hazard from simulation, testing or other severity estimation methods (e.g. vehicle-specific data or data relevant to future applications), those data can be used. If other safety systems on the vehicle (outside the system analysed in the HARA) reduce potential injury, this can also be considered in assigning severity and the related controllability. The general guidance of this annex is intended to help users understand the complexity of the problem and make appropriate decisions (requiring further expert analysis); this document neither recommends nor endorses a specific severity classification method as part of the HARA.

In the absence of specific actionable guidance in GB/T 34590 (all parts), literature and historical accident databases (including post-crash reconstructed relative speed and AIS injury ratings) were analysed. Table B.1 considers damaged area, maximum AIS (MAIS) of injured persons, direction of impact force, collision object and use of occupant restraints. Table B.1 of Annex B of GB/T 34590.3-2022 gives general guidance for reviewing injury ratings; based on different analyses and reviews of post-crash relative speed estimates, Table B.1 summarises relative speed ranges. Although injury ratings generally rise with crash speed, the speed ranges assigned to S0 to S3 vary widely with the data sources and crashes considered; they are based on post-crash reconstruction but can give initial general guidance for S0 to S3 assignment. Use of Table B.1 is not a requirement of this document. To obtain a discrete set of ranges, the analyst can select a single data source and apply suitable selection and severity criteria, after which the speed ranges do not overlap. Note: data sources for Table B.1 include GIDAS and other databases worldwide (references [5], [6], [7]); the speed intervals are for reference only and actual analysis should use data sources of the target market.

Table B.1 (minimum and maximum delta-v ranges from analyses of different accident databases). Frontal: S0 maximum <4 km/h to 10 km/h (not defined in some analyses); S1 minimum >4 km/h to 10 km/h, maximum <20 km/h to 50 km/h; S2 minimum >20 km/h to 50 km/h, maximum >=40 km/h to 65 km/h; S3 minimum >40 km/h to 65 km/h. Rear: S0 maximum <4 km/h to 10 km/h; S1 minimum >4 km/h to 10 km/h, maximum <20 km/h to 50 km/h; S2 minimum >20 km/h to 50 km/h, maximum <=40 km/h to 60 km/h; S3 minimum >40 km/h to 60 km/h. Side: S0 maximum <2 km/h to 10 km/h; S1 minimum >2 km/h to 10 km/h, maximum <8 km/h to 30 km/h; S2 minimum >=8 km/h to 30 km/h, maximum <16 km/h to 40 km/h; S3 minimum >16 km/h to 40 km/h. Note: the list is not exhaustive; severity classification of a hazardous event should consider participants potentially at risk, including pedestrians, cyclists and occupants of other vehicles (whether or not on public roads).

B.2 Explanation. Table B.1 is based on different traffic accident data; to obtain specific results for selected scenarios in the HARA, appropriate filter criteria should be chosen carefully, considering the scope of analysis and making necessary adjustments for the nature of the hazard. The analyses used for Table B.1 applied: selection of a suitable count for analysis (e.g. number of accidents, vehicles in accidents, or persons involved); various factors considered, e.g. collision type, offset, restraint use, occupant age; severity classification based on the concepts of GB/T 34590.3-2022: S0 - damage not classifiable as safety-related, e.g. minor collision with roadside infrastructure (not S1, S2 or S3); S1 - probability of AIS 1 to 6 greater than 10 % (not S2 or S3); S2 - probability of AIS 3 to 6 greater than 10 % (not S3); S3 - probability of AIS 5 to 6 greater than 10 %.

When using accident data from different sources as a basis for severity classification: although accidents are sampled by a well-defined method, there are some deviations from official statistics, which can be compensated by standardised and published weighting methods; when using existing databases to determine accident severity for vehicles still in development, improvements in active and passive safety and road infrastructure over that period should be considered - one possible way is to consider only recent vehicle models or cars equipped with certain systems (e.g. ABS, ESC, curtain airbags, pedestrian protection); a given hazardous situation can lead to a range of possible accident scenarios, and analysts should avoid detailed analyses that can only be made in hindsight and cannot be predicted in the HARA.

Each individual analysis of the above data sources produced a set of discrete speed ranges for S0 to S3; Table B.1 summarises the independent analyses, defining a minimum and maximum speed range for each class. The ranges reflect the overlap of discrete ranges from different analyses, which may be due to differences in data sources and methods, such as: regional driving patterns and environment; crash selection criteria of in-depth databases; extrapolation from in-depth databases to the wider population; regional fleet composition; vehicle selection criteria (e.g. vehicle age, fitment of specific technologies such as airbags); definition of collision types (frontal, side, rear), e.g. damaged plane, direction of impact force; categorisation of collision types (e.g. overlap); collision objects included and their categorisation; occupant envelope (e.g. seating position, restraint use); occupant characteristics (e.g. age); non-occupant injury outcomes included (e.g. pedestrians, occupants of other vehicles). Users are advised to ensure that the data sources and interpretation are appropriate for the hazardous event being analysed.

Annex C (informative) Example of hazard analysis and risk assessment for the steering function

C.1 General. This annex gives a HARA example for the electric power steering (EPS) assist function. C.3 provides a HAZOP analysis identifying EPS malfunctioning behaviours corresponding to vehicle-level hazards; C.4 gives examples of some EPS malfunctions, the resulting vehicle-level hazards and the associated ASILs. The annex does not represent a complete HARA of the steering function, but a subset of functional safety hazards of the EPS function, given as guidance. Note: the annex contains example ASILs for selected hazardous events; ASIL determination is agreed between the parties concerned. Annex B of GB 17675-2021 gives minimum requirements for steering systems.

C.2 Item definition: overview of the functional concept. The EPS function assists the driver in providing directional control of the vehicle through the steered wheels while reducing the effort the driver needs to steer. EPS measures driver intent at the steering wheel and processes it together with other vehicle inputs to provide steering torque assist. The scope of this analysis assumes that the EPS system has a mechanical steering linkage, so that when EPS assist is lost the driver can still steer the vehicle manually.

C.3 HAZOP analysis. Table C.1 lists the HAZOP analysis identifying malfunctioning behaviours of the EPS assist function: loss of assist (loss of function); excessive assist (more than intended); insufficient assist (less than intended); reversed assist, i.e. assist in the direction opposite to that requested; unintended assist (provided when not demanded); steering lock, i.e. steering output stuck at a fixed value or position. Table C.2 maps these to vehicle-level hazards: loss of assist and insufficient assist lead to heavy steering (increased steering effort); excessive assist, reversed assist and unintended assist lead to unintended lateral vehicle motion / unintended yaw; steering lock leads to loss of lateral vehicle motion control.

C.4 Hazard analysis and risk assessment. Table C.3 shows a partial example of the HARA of the EPS assist function; the examples include vehicle motion control hazards related to the steering assist function that are relevant to functional safety.

Table C.3, steering hazard #1 (unintended assist or reversed assist; vehicle-level hazard: unintended lateral motion / unintended yaw; no assumptions). Detailed description: the steering system provides unintended steering torque when not requested by the driver, or provides torque in the direction opposite to the driver's request. Worst-case scenario: before the driver can react, the vehicle leaves its intended path or lane and collides with oncoming or adjacent traffic or roadside objects; unintended yaw torque on turning can lead to loss of vehicle control. S3 (high-speed vehicle collision with other vehicles or objects on a motorway), E4 (daily exposure to urban roads or motorways), C3 (most drivers cannot control this situation): ASIL D. Remark: the hazard applies to steering torque or angle control functions; the ASIL may be reduced depending on vehicle and calibration values and the magnitude of the disturbance.

Steering hazard #2 (excessive assist; unintended lateral motion / unintended yaw; no assumptions). Description: the steering system provides assist greater than the design ratio, i.e. excessive steering assist. Worst-case scenario: while a vehicle travelling at high speed on a motorway changes lane, increased assist may cause the driver to oversteer; before the driver can react, the vehicle leaves its intended path or lane and collides with oncoming or adjacent traffic or roadside objects. The driver feels the steering lighter than normal, but the response direction matches the driver's request. S3 (high-speed collision on a motorway), E4 (daily exposure to urban roads or motorways), C1 (simply controllable): ASIL B. Remark: applies only to steering torque control functions; the ASIL may be reduced depending on vehicle and calibration values and the magnitude of the disturbance.

Steering hazard #3 (steering lock; unintended loss of lateral motion control; assumption: the steering system contains an electrical resistance). Description: the steering system locks electrically or sticks at a certain position, and does not respond to the driver's steering request while the vehicle is moving; this malfunction makes manual steering impossible. Worst-case scenario: the vehicle continues moving with the last position of the steering system and wheels and cannot turn; before the driver can control it, the vehicle leaves its intended path or lane and collides with oncoming or adjacent traffic or roadside objects. S3, E4, C3 (same rationales as hazard #1): ASIL D. Remark: applies to steering torque or angle control functions.

Steering hazard #4 (loss of assist; heavy steering - increased steering effort; assumptions: mechanical steering linkage is present and the steering system complies with GB 17675-2021). Description: sudden loss of steering assist while the vehicle is moving. Worst-case scenario: at higher speed only a small steering force is needed, while at low speed the driver must steer by hand; sufficient steering force may be difficult for some drivers to apply at the moment of low-speed driving and when turning, and steering challenges can lead to collisions with vehicles or pedestrians in the traffic. S, E and C ratings vary by vehicle; for sudden loss of assist, the ASIL depends on vehicle design and configuration, and severity, exposure and controllability can be based on: severity - vehicle crash speed, potential collision with vehicles, roadside objects or pedestrians, and the severity table B.1 of Annex B; exposure - duration of specific vehicle speed ranges at different lateral accelerations and the possibility of exposure to hazards; controllability after loss of assist depends on several factors related to steering system design and vehicle characteristics, of which the steering force is an important metric.

Notes to hazard #4: Note 1 - see GB 17675-2021 (maximum steering force with the steering system intact) and MIL STD 1472; the reference value for the C1 upper limit for M1 and M2 vehicles is 150 N. Note 2 - other considerations: the steering behaviour of current systems on the market without assist may be acceptable; the steering behaviour without assist of systems on the market can be used as the benchmark for designing the controllability metric of future systems. General note to Table C.3: after the HARA, a safety goal is defined for each hazard; the definition of the safety goal can take into account the controllability results of the market representing the target market's persons at risk.

Annex D (informative) Example of hazard analysis and risk assessment for propulsion and driveline functions

D.1 General. In accordance with GB/T 34590 (all parts), this annex gives examples, guidance and rationale for HARA to determine the ASIL for malfunctioning behaviours and vehicle-level hazards related to propulsion and driveline functions. It does not represent a complete HARA of these functions but a subset of assessment examples, which should not be used to define a minimum or maximum ASIL for any specific vehicle system. Only examples are given for which enough valid data or clear expert consensus exist to allow a common assessment and to show that they are instructive. In an actual HARA, additional scenarios need to be evaluated to find the scenario giving the highest functional safety level. Note: the annex contains example ASILs for selected hazardous events; ASIL determination is agreed between the parties concerned.

D.2 Item definition: overview of the functional concept. Since this document gives general recommendations rather than a specific system assessment, the item definition is kept as generic as possible: only basic propulsion and driveline functions are listed, and additional content is added only where shown to be relevant to the example risk assessment. Note: some parameters are strongly vehicle- and system-dependent and can lead to different risk assessment results for different vehicles; they are considered in the specific HARA to ensure reasonable results.

Table D.1 (function list). Provide powertrain start/stop selection: conventional engine start/stop; electric motor start/stop; start/stop with or without creep mode; key start/stop; automatic start/stop system; start/stop for other reasons (e.g. automatic cooling/heating). Provide selectable driving direction: forward (D), reverse (R), neutral (N) - the basic function is 'vehicle moves' (forwards/backwards/not moving), provided by the automatic transmission or shift-by-wire system. Provide requested propulsion torque: via conventional, electric or hybrid powertrain. Provide braking torque: via regenerative braking (electric vehicles), engine drag torque (conventional vehicles) or the automatic transmission (Note 1: for the automatic transmission, different modes such as automatic, sport and economy may need to be distinguished); regenerative braking takes two forms: 1) independent of service braking - releasing the accelerator pedal produces regeneration from a higher-than-usual drag torque (vehicle-dependent); 2) related to service braking - regeneration after pressing the brake pedal, combined with the braking system deceleration (Note 2: form 2 is outside the scope of this annex). Provide selectable/automatic hill hold (rollaway prevention): via automatic park (Auto-P) or manual park (P), including automatic and manual release; one E/E related system is considered for hill hold.

D.3 Hazard and operability analysis. For each analysed function, the relevant vehicle-level hazards are derived from potential unintended system states; Table D.2 gives an overview. The last column indicates whether a malfunction leads to the same risk assessment result as another malfunction, in which case no additional example is given in this annex.

Table D.2 (HAZOP results mapping functions, malfunctions and potential vehicle-level hazards). F1 powertrain start/stop: F1-1 unintended powertrain activation - unintended acceleration (creep); F1-2 unintended powertrain deactivation - loss of acceleration capability (coasting); F1-3 powertrain cannot be activated - no hazard. F2 selectable driving direction: F2-1 moves in unintended direction - motion in incorrect direction; F2-2 cannot move - no hazard; F2-3a unintended engagement of forward/reverse instead of neutral - unintended acceleration (creep-like), same as F1-1; F2-3b unintended engagement of park instead of neutral - loss of longitudinal motion (low speed), same as F2-4b; F2-4a unintended engagement of forward/reverse while in neutral - unintended acceleration (creep-like), same as F1-1; F2-4b unintended engagement of park while in neutral - loss of longitudinal motion (low speed).

Table D.2 (continued). F3 requested propulsion torque: F3-1a propulsion torque greater than requested - unintended acceleration (vehicle stable); F3-1b propulsion torque greater than requested - unintended rotational motion about the vertical axis (yaw); F3-2 propulsion torque less than requested - loss of acceleration capability (coasting). F4 braking torque: F4-1a braking torque greater than requested - unintended deceleration (vehicle stable); F4-1b braking torque greater than requested - unintended yaw; F4-2 unintended lack of regenerative braking deceleration (on accelerator release) - loss of deceleration capability; F4-3 unintended lack of drag torque - loss of deceleration capability. F5 hill hold: F5-1a unintended activation with vehicle stationary - loss of longitudinal motion (axle locked), same as F2-4b; F5-1b unintended activation while driving - loss of longitudinal motion (axle locked); F5-1c unintended activation while driving - unintended yaw; F5-2 unintended deactivation of hill hold - unintended longitudinal motion; F5-3 hill hold cannot be provided - unintended longitudinal motion.

D.4 Hazard analysis and risk assessment. D.4.1 Vehicle operational situations / hazardous scenarios. For this annex only some typical operational situations are analysed as examples of risk assessment for each hazard; each situation should be combinable with a specific malfunction for systematic evaluation of the specific hazardous scenario. D.4.2 Selection of examples. Each fault and hazardous event requires detailed discussion and clear evaluation. All available results (highest ASIL for specific faults) were collected from HARAs performed by the organisations concerned. Where all HARA results were identical, only one descriptive example of a hazardous event is listed to illustrate the common result; where results differed, different examples and more detailed explanations are used to explain the reasons. Specific examples are in Table D.3. Note: the examples are not an exhaustive list of hazards; other possible malfunctions or related vehicle-level hazards are subject to specific HARA of the actual item.

Table D.3 (HARA examples for propulsion and driveline functions), F1 and F2. F1-3 powertrain cannot be activated (no vehicle-level hazard; no assumptions): the vehicle is stationary, the powertrain is off and the driver wants to start the vehicle; the vehicle remains stationary with no hazardous effect - S0, E4, ASIL QM. F2-2 vehicle cannot move (no hazard; assumption: unintended motion while in neutral should be analysed separately): the vehicle remains stationary with no hazardous effect - S0, E4, ASIL QM. F2-4b unintended engagement of park while in neutral (loss of longitudinal motion at low speed; assumption: shifting from forward gear to park while moving is discussed separately, see F5-1): vehicle in a car wash; the vehicle and car wash may be damaged - S0 (unintended engagement of park causes driveline shaft lock; vehicle and car wash damaged, no personal injury), E2 (vehicle in a car wash), ASIL QM. Remark: automatic engagement of park after a certain time in neutral may be a system function.

Table D.3, F3-1a propulsion torque greater than requested, unintended acceleration with vehicle stable. Assumptions: the assessment is valid for vehicles with typical propulsion torque; for high-performance drive systems with larger torque, distance, collision speed and reaction time must be considered together to decide whether a higher ASIL is more appropriate (see the example in D.5.3); the risk of instability should also be assessed (see the F3-1b example). F3-1a(1): vehicle on urban or country road following another vehicle; front of the vehicle collides with the rear of the other vehicle - S2 (front-to-rear collision at medium speed, e.g. relative speed 20 km/h), E4 (other vehicles ahead are very common, judged more than 10 % of operating time), C2 (the situation can be controlled by pressing the brake pedal, the driver's intuitive reaction; in most cases reaction time is sufficient to avoid the specific hazard): ASIL B.

F3-1a(2): vehicle at low speed (e.g. in first gear) with pedestrians in the hazard zone; frontal collision with a pedestrian at some speed (no run-over assumed) - S2 (collision speed relatively low because initial speed is low, and pedestrians are assumed near the vehicle), E3 (pedestrians around the vehicle while driving, e.g. at intersections and parking lots, account for a high proportion; however only a certain proportion of driving time is spent in such locations with pedestrians always in the hazard zone), C3 (some drivers are startled by the unintended acceleration and by the momentary closeness of vehicle and pedestrian, prolonging reaction time; fewer than 90 % of drivers or all traffic participants can usually, or only barely, avoid the hazard): ASIL B. F3-1a(3): vehicle at low speed (e.g. first gear) in an area where pedestrians are vulnerable to run-over; frontal collision with and run-over of a pedestrian; these situations depend on the pedestrian and on the specific vehicle design (see D.5.3) - S3 (scenario focusing on run-over, severity assessed as S3), E2 or E3 (as F3-1a(2), but because the focus is on run-over scenarios exposure may be reduced; there is not yet data establishing a general exposure result for all vehicles), C3 (as F3-1a(2)): ASIL B or C.

F3-1b propulsion torque greater than requested, unintended yaw rate change / unintended rotation about the vertical axis. Assumptions: the highest ASIL of the system depends on the potential vehicle instability caused by the fault in specific driving scenarios, usually determined by system characteristics, e.g. a) magnitude (N.m) and gradient (N.m/s) of unintended torque; b) powertrain concept (front/rear drive), vehicle mass, load distribution. For evaluation, the analysis should select relevant scenarios with the most relevant parameters: road friction, vehicle speed, turning speed. Worst-case scenario: frontal or side collision with roadside objects or oncoming vehicles. S2 or S3: if the vehicle loses traction and the driver cannot prevent the unintended yaw rate change, a) a front-drive vehicle slides forward (understeer), possibly at reduced speed, off the road and into roadside objects (e.g. trees); b) a rear-drive vehicle oversteers very quickly and may have a side collision with an oncoming vehicle or roadside objects.

F3-1b (continued). E2 to E4: the most important scenario for the ASIL rating is a vehicle on a typical country road at medium speed with moderate lateral acceleration; exposure depends on whether the system characteristics are stable on a) dry road (E4), b) wet road (E3), or c) only ice/snow road (E2); for conventional vehicles with typical torque level and powertrain state the highest is E3, while electric vehicles differ. Note: higher vehicle speed and higher lateral acceleration may lower the E class. C2: the driver's first emergency reaction is to press the brake pedal, and the driver may then shift to neutral or switch off the engine. ASIL QM to C; remark: the ASIL is highly dependent on vehicle and system characteristics.

F3-2 propulsion torque less than requested, loss of acceleration capability (coasting). Assumption: care is needed if the driving situation is at the limit of stability; sudden loss of torque can cause instability (as lateral forces are affected by changes in longitudinal forces), see F4-1. Scenario: vehicle overtaking on a country road with oncoming vehicles; frontal collision with an oncoming vehicle - S3 (if overtaking cannot be completed quickly as intended, a frontal collision with an oncoming vehicle is possible; injury severity is related to high vehicle speed), E2 (duration-based assessment: overtaking with oncoming vehicles is a short manoeuvre with few opportunities, generally not more than 1 % of operating time), C1 (overtaking with oncoming traffic requires more attention and concentration from the driver; the driver can decelerate or brake and return to the original lane, and the oncoming driver can also decelerate and take avoiding action): ASIL QM.

F4 braking torque. F4-1a braking torque greater than requested, unintended deceleration with vehicle stable: this type of hazard is covered in Annex F, see F.4.1 (braking hazard 1). Assumption: the highest ASIL of the system depends on the magnitude of deceleration and on the unintended deceleration caused by the fault.

F4-1b(1) braking torque greater than requested (rear drive), unintended yaw rate change / unintended rotation about the vertical axis. Assumptions as for F3-1b: the highest ASIL depends on potential instability caused by the fault in specific scenarios, determined by system characteristics such as magnitude (N.m) and gradient (N.m/s) of unintended torque, powertrain concept (front/rear drive), vehicle mass and load distribution; relevant parameters are road friction, vehicle speed and turning speed. Worst case: frontal or side collision with roadside objects or oncoming vehicles. S3: if the vehicle loses adhesion and the driver cannot prevent the unintended yaw rate change, a rear-drive vehicle oversteers very quickly and, without prior deceleration, often has a side collision with oncoming vehicles or roadside objects. E2 to E4: the most important scenario is a vehicle at medium speed (e.g. 100 km/h) with only limited lateral acceleration (e.g. 2 m/s2); exposure depends on stability on dry road (E4), wet road (E3) or only ice/snow road (E2); note: higher speed and higher lateral acceleration may lower the E class. C3: when the vehicle loses adhesion and stability on wet or icy/snowy road, the driver cannot regain control; oncoming vehicles may react and decelerate, but collisions with roadside objects are hard to control. ASIL B to D; remark: highly dependent on vehicle and system characteristics.

F4-1b(2) braking torque greater than requested (front drive), unintended yaw rate change / unintended rotation about the vertical axis; assumptions and relevant parameters as for F4-1b(1). Worst case: frontal/side collision with roadside objects or oncoming vehicles. S2 or S3: if the vehicle loses adhesion and the driver cannot prevent the unintended yaw rate change, a front-drive vehicle continues straight on (in the turning situation); on a dry road the vehicle decelerates quickly but may leave the road at some speed and hit roadside objects such as trees (S2); on wet, slippery or icy roads, where speed is not effectively reduced, a collision is possible (S3). E2 to E4: most important scenario is medium speed (e.g. 100 km/h) with limited lateral acceleration (e.g. 2 m/s2); stability on dry road (E4), wet road (E3) or ice/snow only (E2); note: higher speed and lateral acceleration may lower the E class; the E4 scenario leads to S2, while E2/E3 scenarios may also lead to S3. C3: as for F4-1b(1). ASIL B or C; remark: highly dependent on vehicle and system characteristics.

F4-2 unintended lack of regenerative braking deceleration (on accelerator release), loss of regenerative braking deceleration capability; assumption: similar to 'unrequested vehicle coasting'. Scenario: vehicle at low speed approaching a pedestrian crossing, the driver expects to stop the vehicle by regenerative braking deceleration; low-speed collision with a pedestrian. C0: controllable in general by everyone, at least as long as the regenerative braking deceleration expected by the driver is not too high (e.g. < 3 m/s2); ASIL QM. F4-3 unintended lack of drag torque, loss of drag deceleration capability; assumption: similar to 'unrequested vehicle coasting'. Scenario: vehicle at low speed approaching a pedestrian crossing, the driver expects to stop by drag-torque deceleration; low-speed collision with a pedestrian. C0: as long as the braking system works, controllable in general by everyone; ASIL QM. Remark: vehicles with heavy trailers may need drag torque on downhill gradients to avoid brake system overheating.

F5 selectable/automatic hill hold. F5-1b unintended activation of hill hold while driving, unintended deceleration: independent of the system assessment (a 'general hill hold function'), see F4-1a. F5-1c unintended activation while driving, unintended yaw rate change / unintended rotation about the vertical axis: independent of the system assessment, see F4-1b.

F5-1d unintended activation of hill hold while driving, loss of longitudinal motion (very low speed). Assumptions: special case with a typical parking lock system; maximum torque depends on the park lock mechanism, as it breaks above a certain strength; it is assumed that a mechanical measure prevents engagement of the park lock above a certain minimum drive shaft speed; in this case the fault can only occur when the drive shaft speed is very low or wheel slip causes stopping (e.g. on low-friction roads without ABS braking). Description: vehicle travelling at low speed (< 5 km/h) through an intersection when the fault occurs, with another vehicle approaching from the side; side of the vehicle struck by the front of the other vehicle. S2 (final impact of the side vehicle in the range 25 km/h <= delta-v <= 35 km/h), E2 (the relevant situation is below 1 % of total operating time, e.g. merging onto a road or crossing a lane and passing a lane with right of way), C2 (the driver can avoid exposing the vehicle to collision risk; with correct driving, the side vehicle normally has enough time to brake): ASIL QM; see D.5.1.

F5-2/F5-3 unintended deactivation of hill hold or hill hold cannot be provided, unintended longitudinal motion. Assumptions based on the following basic system characteristics: (1) the fault can only occur when the electrical system is active; for plug-in electric vehicles activation times are longer than for conventional vehicles; (2) when automatic parking brake is used, driver expectations differ. Description: engine off, vehicle parked on a slope with sufficient rolling distance (to reach a hazardous speed), with pedestrians or other road users in the hazard zone (downhill); collision with pedestrians or other road users. S: severity can be derived from the collision speed, which mainly depends on distance and gradient. E: parking on a slope is a common event, but the probability of free rolling space with a pedestrian in the hazard zone depends on the assumed gradient and distance. C: with the driver not in the vehicle, controllability is assumed C3 because pedestrians may not notice the hazard or may not react quickly enough; with the driver still in the vehicle, controllability depends on driver state (distracted, in a hurry, etc.) and reaction time (related to gradient and distance). ASIL: see D.5.2 for detailed explanation and guidance.

F5-4 hill hold cannot be deactivated (no vehicle-level hazard; assumption: not safety-related, S0). Vehicle stationary with hill hold activated and the driver wants to start the vehicle; the vehicle remains stationary with no hazardous effect - S0, E4, ASIL QM. General note to Table D.3: after the HARA, a safety goal is defined for each hazard; the definition of the safety goal can take into account the controllability results of the market representing the target market's persons at risk.

D.5 Detailed description of examples. D.5.1 Assessment and calculation of the exposure class. D.5.1 to D.5.3 give the specific steps for assessing the examples of Table D.3. F5-1 (hill hold function) illustrates experience-based assessment of exposure. Hazardous scenario of F5-1d: the vehicle is stopped at an intersection at a red light; when the light turns green the first vehicle starts and accelerates; a vehicle arrives from the side whose driver expects the first vehicle to clear the intersection quickly; at that moment the hill hold function of the first vehicle activates unintentionally, with the two vehicles quite close. Step 1: discuss relevant aspects of the scenario to improve understanding of its description and parameters: it is assumed that a mechanical measure prevents engagement of the park lock above a specific minimum drive shaft speed (e.g. 5 km/h), so the fault occurs before this speed is reached; in normal driving the driver from the side recognises that a vehicle is crossing and avoids entering the intersection too fast.

Step 2: experience-based estimate of the required parameters: 1) assumed acceleration time 2 s (until 5 km/h is reached); 2) assumed number of intersections per drive cycle: 20; 3) relative share of crossing situations in which a car enters the intersection from the side in a hazardous way: one tenth. Step 3: calculate scenario duration. Depending on the scenario, exposure should be assessed based on duration (relative to operating time) or frequency (relative to number of drives); basic data are needed for quantitative assessment, from which the upper and lower limits of the E classes can easily be calculated per GB/T 34590.3-2022, as in Table D.4.

Table D.4 (calculated ranges of exposure classes). Duration-based description in GB/T 34590 (all parts): E1 not defined; E2 < 1 % of average operating time; E3 1 % to 10 %; E4 > 10 %. Based on assumed operating time: E1 < 0.4 h/year; E2 0.4 h/year < x <= 4 h/year; E3 4 h/year < x <= 40 h/year (printed in the source as '4 h/year < x <= 4 h/year'); E4 > 40 h/year. Frequency-based description: E1 less often than once a year for most drivers; E2 a few times a year for most drivers; E3 once a month or more often for an average driver; E4 during almost every drive on average. Based on assumed number of drives: E1 < 1 per year; E2 1 per year < x < 10 per year; E3 10 per year < x < 100 per year; E4 > 100 per year.

For the given example, exposure should be assessed based on duration, since the fault can immediately lead to the hazard. The calculation is: average scenario duration 4 s per drive cycle (from the step 2 assumptions); assuming 1 000 drive cycles per year, the duration is 4 000 s/year, about 1 h/year; since this is less than 1 % of normal operating time (400 h/year), E2 is obtained. However, this is only an experience-based estimate not fully supported by statistical data; in particular for parameters with a large influence on the result, customer or field survey data should be obtained.

D.5.2 Assessment of scenarios with strong interdependence between exposure, severity and controllability. F5-2: unintended deactivation of hill hold. For malfunctions such as F5-2, the strong interdependence between exposure, severity and controllability should be analysed to make an appropriate risk assessment for a set of scenarios; additional guidance follows. Hazardous scenario of F5-2: engine off, vehicle parked on a slope with sufficient rolling distance (to reach a hazardous speed); the driver has left the vehicle and, when the failure occurs, a pedestrian is in the hazard zone (downhill). Step 1: discuss relevant aspects to improve understanding of the scenario and parameters (Figure D.1 illustrates the scenario: a car rolling down a slope towards a pedestrian). Assumed conditions: before the fault the vehicle is stationary with rollaway prevention active; since the driver has left the vehicle, avoiding the hazard is impossible; with no reference estimate of pedestrian avoidance action, C3 can be assumed. Parameters: gradient (affecting vehicle acceleration); distance between vehicle and pedestrian.

Step 2: simulation calculation of relevant parameters. The collision speed is calculated using the acceleration derived from the gradient and the vehicle-pedestrian distance (corresponding to duration) as parameters; combined with E and S judgement, the ASIL can be derived for all relevant scenarios (Figure D.2). Figure D.2 is a severity diagram for the F5-2 scenario, plotting gradient in % (steep at top, gentle at bottom, divided into exposure bands e1 to e4 depending on gradient) against distance in m (near to far), divided into zones 1 to 9 shaded dark grey, grey and light grey. Step 3: typical scenario and ASIL. Controllability of the whole scenario is C3, because the driver has left the vehicle and, for close-range events, the pedestrian's reaction cannot be assumed (with no data on when a pedestrian notices a moving vehicle, avoidance action is unknown).

Severity is determined by simulation of: longitudinal - acceleration value corresponding to the gradient (g); lateral - acceleration time corresponding to the vehicle-pedestrian distance; for a pedestrian struck from behind, collision speed is the main S criterion: dark grey zone -> S3; grey zone -> S2; light grey zone -> S1. Determining the exposure class requires an integrated judgement combining the exposure condition as a class probability e(theta) with the duration e(d) of the pedestrian being in the hazard zone; for example, from the combination of e3(theta) and e3(d), the overall exposure of zone 6 is rated E2. Finally, from the HARA assessment table, the example with the highest ASIL can be selected as the 'typical scenario'. Other scenarios should also be analysed to find which situation leads to the highest ASIL; the HARA should include: scenarios with the driver still in the vehicle (affecting E and C); driver distracted or leaving the vehicle in a hurry (affecting E and C); collision with a vehicle from the side (affecting S, E and C). Where appropriate, a similar analysis method can be used to describe consistent typical scenarios.

D.5.3 Assessment of unintended acceleration (stable) scenarios. F3-1a: propulsion torque greater than requested. This malfunction can cause unintended vehicle acceleration; for appropriate risk assessment the following aspects should be considered. The main assessment scenarios are a vehicle following another vehicle with possible rear-end collision, and a vehicle at very low speed with a pedestrian in the hazard zone in front. Additional guidance: Scenario 1, driving behind another vehicle. Figure D.3 illustrates scenario F3-1a: after unintended acceleration (acceleration G rising over time), the driver's brake pedal force/deceleration characteristic (delay time, maximum pedal force, deceleration G) determines the outcome; factors considered: controllability C - vehicle acceleration; exposure E - following distance; severity S - relative speed at collision.

To assess the risk correctly, the parameters of Figure D.3 should be analysed: change in vehicle acceleration; effective deceleration from the driver pressing the brake pedal with a certain force; exposure for different distances between the two vehicles; exposure for different vehicle types, assuming different vehicle types lead to different severities (e.g. if the other vehicle is a heavy truck the relative collision speed is higher, but the probability of following a truck is lower than of following an ordinary passenger car). Scenario 2, low-speed driving with a pedestrian in the hazard zone: applies to a vehicle at low speed (e.g. first gear) with a pedestrian in its direction of travel; common examples are intersections or parking lots.

To assess the risk appropriately, one approach is to focus on the most severe scenario that can cause fatal injury (e.g. run-over), in which the chance of avoiding that specific harm by controlling the vehicle is small. This occurs when certain boundary conditions hold: a driving situation the driver can easily fail to control; a pedestrian in the hazard zone in front of the vehicle; no other obstacle between vehicle and pedestrian that could prevent the collision; the pedestrian in a position where run-over is possible. Note: the last condition depends on the specific vehicle design, since in the same situation some vehicles are more likely to run over a pedestrian than others; relevant design aspects include ground clearance, front profile and passive pedestrian protection measures. Exposure assessment guidance: a large proportion of drive cycles includes areas with pedestrians (e.g. intersections, parking lots), but driving time spent there is estimated to be only a certain proportion, and pedestrians are not always in the hazard zone in front of the car. Because the focus is on run-over scenarios, the probability is further reduced to some extent; however, there is currently no established data allowing the exposure class to be considered a general result for all vehicles.

Annex E (informative) Example of hazard analysis and risk assessment for suspension control functions

E.1 Introduction. This annex gives HARA examples for suspension control functions. E.3 provides a HAZOP analysis identifying malfunctioning behaviours of a few suspension control functions; E.4 gives examples of some suspension control malfunctions, the resulting vehicle-level hazards and associated ASILs. As guidance for the HARA of suspension functions, it analyses only part of the hazards of a few suspension control functions and does not represent a complete HARA of all suspension control functions. Note: the annex contains example ASILs for selected hazardous events; ASIL determination is agreed between the parties concerned.

E.2 Item definition: overview of the functional concept. The main role of suspension control functions is to enhance vehicle handling in turns and to improve ride comfort by damping road noise and vibration. The scope of this example includes four suspension control functions: damping control, level control, stiffness control and roll control. These functions differ in passive, semi-active and active suspensions; in semi-active and active control functions, electronic sensors and controllers are used to control suspension dampers, air springs, shock absorbers, anti-roll bars and other suspension devices.

E.3 Hazard analysis. Table E.1 shows the malfunctioning behaviours of a few suspension control functions identified by HAZOP; faults of many suspension control functions correspond to more than one vehicle-level hazard, and Table E.2 lists example vehicle-level hazards. Table E.1: damping control (controls the damping coefficient) - loss of damping control; excessive damping control; insufficient damping control; reversed damping control (damping applied in the direction opposite to that requested); unintended damping control (automatic damping); damping cannot be adjusted. Level control (controls the level position of each wheel) - loss of level control; excessive, insufficient or reversed level control; unintended level control; level position cannot be adjusted. Stiffness control (controls suspension stiffness) - loss of stiffness control; excessive, insufficient or reversed stiffness control; unintended stiffness control; stiffness cannot be adjusted. Roll control (improves vehicle roll stability) - loss of roll control; excessive, insufficient or reversed roll control; unintended roll control; roll control locked.

E.4 Hazard analysis and risk assessment. Table E.2 gives HARA examples for a few suspension control functions; for all four, the vehicle-level hazard is unintended vehicle motion (lateral, longitudinal, vertical). Suspension hazard 1, damping control, unintended or incorrect damping control; assumption: semi-active suspension system controlling the damping coefficient of the dampers, with the vehicle becoming unstable in each damping control state. Description: under certain driving conditions, a malfunction of damping control causes potential loss of longitudinal or lateral traction of the tyres, which can lead to unintended reduction of vehicle stability or increased braking distance. Worst-case scenario: sharp turn or lane change (moderate lateral acceleration of 0.3 g to 0.5 g) while road disturbance brings the vertical motion to the resonance frequency of the unsprung mass. Possible ASIL range depending on vehicle: QM to A.

Suspension hazard 2, level control, incorrect or unintended level control at one or more wheels; assumption: independent active level control of each wheel. Description: unintended or incorrect level control at one or more wheels affects the vehicle's centre of gravity or causes incorrect force distribution on the wheels. Worst case: sharp turn or continuous lane change (moderate lateral acceleration of 0.3 g to 0.5 g), where a level control malfunction may cause yaw moment or roll moment. ASIL range: QM to C. Suspension hazard 3, stiffness control, incorrect or unintended stiffness control acting on one or more wheels; assumption: independent active stiffness control of each wheel. Description: under certain driving conditions, a stiffness control malfunction causes potential loss of longitudinal or lateral tyre traction, which can lead to unintended reduction of vehicle stability or increased braking distance. Worst case: sharp turn or continuous lane change (moderate lateral acceleration of 0.3 g to 0.5 g) with uneven stiffness distribution at diagonal wheels, which may cause yaw or roll moment. ASIL range: QM to B.

Suspension hazard 4, roll control, unintended or incorrect activation of roll control; assumption: active roll control independently controlling the roll moment of each axle. Description: under certain driving conditions, a roll control malfunction causes potential loss of longitudinal and/or lateral tyre traction, which can lead to unintended reduction of vehicle stability or increased braking distance. Worst case: under large lateral acceleration, unintended roll moment may make the vehicle unstable. ASIL range: QM to B. Remark for all four hazards: the ASIL classification of each suspension function depends on the vehicle and on the authority and design of the function; if, within the authority of the control function, no possible malfunction state leads to vehicle instability, the hazard does not apply. Note to Table E.2: after the HARA, a safety goal is defined for each hazard; its definition can take into account the controllability results of the market representing the target market's persons at risk.

E.5 Other considerations. Suspension control functions differ in passive, semi-active and active suspensions. When performing the HARA of suspension control functions, the influence of the type and authority of the control function on vehicle control should be considered together with the overall vehicle design to assess the ASIL of the safety goals; the final ASIL depends on the specific vehicle.

Annex F (informative) Example of hazard analysis and risk assessment for braking and parking brake functions

F.1 General. This annex gives examples, guidance and rationale for determining ASILs using HARA in accordance with the requirements of GB/T 34590 (all parts). Only the most relevant malfunctioning behaviours and vehicle-level hazards of the braking and parking brake functions are considered; the annex does not represent a complete HARA of these functions, and the examples are not necessary for defining a minimum or maximum ASIL for any specific vehicle system. The purpose is to provide guidance for assessing specific vehicle hazards. The result of discussing each hazard is presented in one of three ways: a) a range of ASILs; b) an upper limit of the ASIL; c) no recommended ASIL, but guidance on the parameter values used to determine the ASIL. The ASILs referenced in this annex may have been obtained using different ASIL determination processes and different S, E and C values; for the HARA of a specific application, additional scenarios need to be assessed to find which scenario gives the highest ASIL for a specific safety goal. Note: the annex contains example ASILs for selected hazardous events; ASIL determination is agreed between the parties concerned.

F.2 Item definition: overview of the functional concept. F.2.1 Braking functions. The main braking functions addressed are: providing deceleration of the vehicle based on driver input via the brake pedal or input from other vehicle systems (e.g. driver assistance systems); providing vehicle stability by applying wheel brakes in scenarios approaching the physical limits of vehicle dynamics (e.g. via stability control, anti-lock braking, electronic brake force distribution). F.2.1.1 Stability control: a safety-assist or safety-enhancing function whose main purpose is to help the driver maintain controllability of the vehicle; it uses on-board sensors to determine whether the driver's intended input is consistent with the vehicle direction, and if an inconsistency is detected it can help correct it by controlling the braking or throttle function.

F.2.1.2 Anti-lock braking system (ABS): a safety-assist or safety-enhancing function whose main purpose is to prevent wheel lock, helping avoid uncontrolled skidding or reduce braking distance; ABS monitors the speed of each wheel and, if a wheel is detected rotating considerably slower or faster than the others, controls braking with a specific rhythm. F.2.1.3 Electronic brake force distribution (EBD): its main purpose is to optimise the efficiency and stability of the foundation braking system; by adjusting rear wheel brake pressure close to the ideal brake force distribution it prevents over-braking of the rear wheels, optimising rear axle braking regardless of vehicle load. F.2.2 Parking brake function: its main purpose is to keep the vehicle stationary; the parking brake sub-functions addressed are parking brake activation (engagement) and parking brake release, both based on driver request.

F.3 HAZOP analysis. F.3.1 Main braking function. Table F.1 gives the HAZOP analysis of the deceleration function: loss of braking force; excessive braking force; insufficient braking force; opposite direction not applicable; unintended braking; brake lock. Table F.2 maps braking malfunctions to vehicle-level hazards: unintended braking, brake lock (brake output stuck at a fixed value or position) and excessive braking force lead to unintended vehicle deceleration and also to unintended lateral vehicle motion; insufficient and lost braking force lead to unintended reduction of vehicle deceleration capability; unintended loss of stability control, anti-lock (ABS) control or electronic brake force distribution (EBD) control leads to unintended loss of vehicle brake control functions.

F.3.2 Main parking brake functions. Table F.3 gives the HAZOP analysis of the parking brake function. Parking brake engagement: loss of ability to engage the parking brake; insufficient parking brake force; unintended parking brake engagement; loss of ability to release the parking brake (stuck). Parking release: loss of ability to release the parking brake; parking brake cannot be fully released; unintended parking brake release. Table F.4 maps these to vehicle-level hazards: unintended parking brake engagement leads to unintended lateral motion and unintended longitudinal deceleration; unintended parking brake release, parking brake failure and insufficient parking brake force lead to unintended longitudinal motion; parking brake cannot be released or cannot be fully released leads to unintended loss of longitudinal motion.

F.4 Hazard analysis and risk assessment. F.4.1 HARA of braking functions. Table F.5 gives HARA examples for braking functions. Braking hazard 1 (deceleration; unintended braking; unintended vehicle longitudinal deceleration; assumption: no wheel lock): the braking system applies braking without a braking request; worst case: if a following vehicle is too close and cannot stop, a rear-end collision results. Parameters involved may include the characteristics derived from vehicle speed and time gap (from the speeds of both vehicles), the deceleration value caused by the malfunction, the mass ratio of the vehicles involved, safety devices and occupant restraints, reaction time, and the deceleration value and rate of change of the following vehicle (driver capability); other parameters can also be considered. No ASIL given; see item c) of F.1. Braking hazard 2 (deceleration; insufficient braking; unintended reduction of deceleration capability; no assumptions): the braking system provides less braking than actually demanded; potential collision due to insufficient braking; S, E and C depend on the degree of braking force reduction; ASIL QM to D; see item b) of F.1.

Braking hazard 3 (deceleration; unintended braking; unintended vehicle lateral motion; assumption: wheel lock affects vehicle stability): the braking system applies braking without request; the vehicle may leave its lane or collide with other vehicles, pedestrians or objects. S3 (the potential accident of the worst-case scenario can lead to S3 severity), E4 (daily driving on high-adhesion road surfaces), C3 (difficult to control): ASIL D; see item b) of F.1. Braking hazard 4 (drag torque control; unintended activation of drag torque control; unintended vehicle acceleration; no assumptions) and braking hazard 5 (traction control; unintended activation of traction control; unintended loss of vehicle acceleration; no assumptions): these hazards are already covered by the annex on propulsion system functions, see D.4.2 (hazard number F3).

Braking hazard 6 (stability control; unintended loss of braking yaw function; unintended loss of braking yaw stability control; assumption: the driver needs high lateral acceleration G): stability control function unavailable; S3 (worst-case accident can lead to S3), E1 (rare case), C3 (difficult to control): ASIL A; remark: no warning. Braking hazard 7 (anti-lock braking system; unintended loss of ABS function; assumption: the driver needs to decelerate on a low-adhesion road surface): ABS unavailable; S3, E1 (rare case), C3: ASIL A; remark: no warning. Braking hazard 8 (electronic brake force distribution; unintended loss of EBD function; assumption: the driver needs large deceleration): EBD unavailable; S3, E1 to E3 (depends on the vehicle - brake design and vehicle concept), C3: ASIL QM to C; see item b) of F.1. Note to Table F.5: after the HARA, a safety goal is defined for each hazard; its definition can take into account the controllability results of the market representing the target market's persons at risk.

F.4.2 HARA of parking brake functions. Table F.6 gives HARA examples. Parking brake hazard 1 (unintended engagement of rear parking brake; unintended vehicle lateral motion; no assumptions): parking brake activated while the vehicle is moving causes lateral motion and collision with other vehicles, pedestrians or objects; S3 (worst-case accident can lead to S3), E4 (can occur on any type of road, so more than 10 % of average operating time, see Table B.2 of GB/T 34590.3-2022), C3 (fewer than 90 % of all drivers and traffic participants can avoid the hazard of unintended lateral motion): ASIL D; remark: worst-case scenario. Parking brake hazard 2 (unintended engagement of rear parking brake; unintended longitudinal deceleration; no assumptions): parking brake activated while driving; if a following vehicle is too close and cannot stop, a rear-end collision results; depends on vehicle dynamics considerations such as brake design and vehicle concept; ASIL QM to C; remark: see braking hazard 1 for additional considerations.

Parking brake hazard 3 (unintended release of rear parking brake; unintended longitudinal motion; assumption: manual transmission, with the transmission not in the parking gear): worst case - the parking brake is released while the driver is not in the vehicle and the engine is still running; this item is covered by the annex on propulsion system functions, see D.5.2 and D.4.2 (hazard F5-2). Parking brake hazard 4 (rear parking brake fails and cannot engage; unintended longitudinal motion; no assumptions): the parking brake fails when needed, causing unintended longitudinal motion and potential collision with other vehicles, pedestrians or objects; covered by the propulsion annex, see D.5.2 and D.4.2 (hazard F5-3). Parking brake hazard 5 (rear parking brake cannot be released; unintended loss of longitudinal motion; no assumptions): the parking brake is not released when requested, the vehicle cannot move, so there is no hazard; covered by the propulsion annex, see D.4.2 (hazard F5-4). Note to Table F.6: as for Table F.5.

F.5 Explanation and detailed description of examples. F.5.1 General. This subclause gives more detailed background information on how the examples of F.4 are assessed. F.5.2 Assessment of scenarios related to unintended vehicle longitudinal deceleration (applies to braking hazard 1 and parking brake hazard 2). The malfunction is described as providing more braking torque without driver intent, causing unintended vehicle deceleration. Several aspects can be considered for appropriate risk assessment of this hazard; the most important scenario is usually another vehicle following the faulty vehicle, with a possible rear-end collision. Scenario: driving in front of another vehicle. Figure F.1 illustrates the hazardous scenario: the faulty vehicle decelerates unintentionally; the following driver reacts with a delay time and a brake pedal force-deceleration characteristic; factors considered: controllability C - vehicle dynamic deceleration and malfunction; exposure E - following distance; severity S - relative speed at collision.

For appropriate risk assessment, the parameters of Figure F.1 can be included: vehicle dynamic deceleration and the malfunction; effective deceleration produced by the (following) driver's reaction, pressing the brake pedal with a certain force and rate; exposure for the headway between two vehicles at different speeds; exposure for different vehicle types, if this leads to different severity (e.g. if the other vehicle is a heavy truck the delta-v at collision is higher, but the probability of a truck following is lower than that of a regular passenger car). Based on the dynamic deceleration of the vehicle system and potential malfunctions, possible combinations (e.g. following distance, collision speed, reaction time) play an important role in the analysis and may lead to a range of ASILs; additional studies are needed to assess the malfunction appropriately in the whole-vehicle context.

Bibliography

[1] GB 17675-2021, Steering system of automobiles - Basic requirements.

[2] Ministry of Defence. Defence Standard 00-58 HAZOP Studies on Items Containing Programmable Electronics, Issue 2, 19 May 2000.

[3] Code of Practice for the design and evaluation of ADAS, EU Project RESPONSE 3: V5.0, 2009.

[4] http://www.acea.be/publications/article/code-of-practice-for-the-design-and-evaluation-of-adas.

[5] GIDAS, http://www.vufo.de/forschung-und-entwicklung/gidas/?L=1.

[6] ITARDA, http://www.itarda.or.jp/english/e_outline1.php.

[7] NASS/CDS, http://www.nhtsa.gov/NASS.

[8] Considerations for ISO 26262 ASIL Hazard Classification J2980_201804, https://www.sae.org/standards/content/j2980_201804/.