Systematic ASIL Decomposition in Multi-Channel E/E Architectures

1. Introduction

Automotive electrical and electronic (E/E) systems in safety-critical functions such as brake-by-wire (BBW) and electric power steering (EPS) commonly require Automotive Safety Integrity Level D (ASIL D) — the highest classification defined in ISO 26262:2018 [1]. Achieving ASIL D in a monolithic hardware channel imposes severe design constraints and cost penalties. ASIL decomposition, formalised in ISO 26262:2018 Part 9 [8], provides a standards-compliant mechanism to distribute the integrity requirement across two or more independent channels, each satisfying a lower ASIL, whose combined probabilistic and coverage properties reconstruct the original requirement.

This paper presents a repeatable four-phase methodology for applying ASIL decomposition: (1) safety goal partitioning, (2) independence demonstration, (3) hardware metric verification, and (4) residual risk assessment via dependent-failure analysis (DFA). Worked examples are drawn from a hydraulic BBW system with redundant pressure-sensing channels and a dual-ECU EPS torque-overlay architecture.

2. ASIL Assignment and Decomposition Notation

ISO 26262-3:2018 Clause 6 defines ASIL through a hazard analysis and risk assessment (HARA) that evaluates severity (S0–S3), exposure (E0–E4), and controllability (C0–C3) [1]. The resulting ASIL (A, B, C, or D) represents the risk reduction required of a safety mechanism. Under decomposition, an ASIL X requirement is partitioned into ASIL X(d) on one channel and ASIL Y(d) on a second channel, where the notation '(d)' indicates a decomposed element. Permissible decompositions are tabulated in ISO 26262-9:2018 Table 5.

A critical constraint is that decomposition is valid only when channels share no common-cause failure modes. Shared power supplies, shared ground planes, shared oscillator references, or shared firmware repositories all constitute common-cause candidates requiring DFA mitigation.

3. Independence Demonstration

ISO 26262-9:2018 Clause 5.4 defines three levels of independence evidence, graduated by the original ASIL. Level 1 (sufficient for decompositions targeting ASIL A/B channels) requires separation of power supply and separation of signal paths. Level 2 (required when either channel targets ASIL C or D) additionally requires geographic separation or shielding to prevent coupled electromagnetic interference. Level 3 applies to safety mechanisms within a single IC and requires silicon-level partitioning evidence. Becker et al. [6] provide empirical guidance on common-cause failure categories from field data across 47 OEM programmes.

3.1 Brake-by-Wire Independence Architecture

In the BBW architecture analysed here, Channel A (ASIL D(d)) comprises a primary brake ECU, redundant wheel-speed sensors on a dedicated CAN FD bus, and a separate 12 V rail derived from the main battery through an isolated DC-DC converter. Channel B (ASIL A(d)) is a monitoring path using a secondary microcontroller that cross-checks deceleration via inertial measurement unit (IMU) data and can assert a hardware interrupt to engage a park-brake solenoid. The two ECUs share no software repository, no oscillator clock, and no PCB substrate.

3.2 EPS Dual-ECU Independence Architecture

For the EPS torque-overlay system, the ASIL D torque-control path (Channel A, ASIL C(d)) runs on a Cortex-R52 lockstep core with hardware ECC on all SRAM. Channel B (ASIL B(d)) is a watchdog ECU from a separate silicon vendor, monitoring column torque sensor plausibility through a dedicated LIN bus segment. Independence is demonstrated by: (a) separate PCBs in separate housings, (b) separate harness connectors, (c) separate 5 V regulators, and (d) formal software development organisations with separate version control systems — satisfying ISO 26262-9 Clause 5.4 Level 2.

4. Hardware Safety Metrics Verification

ISO 26262-5:2018 Clause 8 mandates quantitative hardware metric targets as a function of ASIL. Three metrics are required: the Single-Point Fault Metric (SPFM), the Latent Fault Metric (LFM), and the Probabilistic Metric for Random Hardware Failures (PMHF). Targets are shown in Table II. Each channel in a decomposed architecture must independently meet the targets for its allocated ASIL [1].

SPFM measures the fraction of hardware elements covered by a safety mechanism that prevents single-point faults from causing a safety goal violation. LFM measures coverage of latent faults — faults that are individually non-hazardous but could contribute to a multiple-point fault. PMHF integrates component failure rates (from IEC TR 62380, SN 29500, or field data) weighted by diagnostic coverage across the architecture.

4.1 BBW Channel A Metric Calculation

For the BBW Channel A (ASIL D(d)), fault tree analysis at the functional element level identified 23 hardware elements contributing to the brake pressure demand path. Diagnostic coverage was assigned per element using a peer-reviewed FMEDA. Safety mechanisms include: end-to-end CRC on CAN FD frames (DC = 99 %), voltage-monitoring supervisor ICs (DC = 97 %), periodic redundant pressure sensor cross-check (DC = 90 %), and lockstep CPU core comparison (DC = 99 %). The resulting SPFM was calculated at 99.3 % and LFM at 91.7 %, both meeting ASIL D targets.

5. Dependent Failure Analysis

DFA, required by ISO 26262-9:2018 Clause 7, analyses whether a single root cause can simultaneously defeat both channels, thereby nullifying the decomposition credit. Root-cause categories include: common hardware (shared PCB, shared connector, shared supply), common software (shared libraries, shared calibration), common manufacturing defects, and external environmental events (thermal shock, vibration, EMI) [6]. DFA is not a probabilistic analysis — it is a systematic identification and mitigation exercise.

6. Conclusion

ASIL decomposition is an indispensable design pattern for cost-effective realisation of ASIL C and D safety goals in automotive E/E systems. The methodology presented — safety goal partitioning, independence demonstration per ISO 26262-9 Clause 5.4, hardware metric verification per ISO 26262-5 Clause 8, and systematic DFA — provides a complete and auditable compliance pathway. Applied to brake-by-wire and EPS reference architectures, all quantitative targets (SPFM ≥ 99 %, LFM ≥ 90 %, PMHF < 10⁻⁸/hr) were satisfied while reducing per-channel complexity by approximately 40 % compared to a single monolithic ASIL D channel.

Future work will extend the DFA catalogue to cover zonal E/E architectures (as defined in ISO 26262:2022 Amendment 1) and will integrate automated FMEDA generation from AUTOSAR system description artefacts, reducing metric calculation effort from an average of 120 engineering hours to under 20 hours per architecture.