SAE J 2980-2015 Considerations for ISO 26262 ASIL Hazard Classification.pdf

1、 SURFACE VEHICLE RECOMMENDED PRACTICE J2980 MAY2015 Issued 2015-05 Considerations for ISO 26262 ASIL Hazard Classification RATIONALE This SAE Recommended Practice is intended to provide guidance for identifying and classifying hazardous events, which are per ISO 26262:2011 1, defined at the vehicle

2、level utilizing the ISO 26262:2011 1 hazard analysis and risk assessment (HARA) method. TABLE OF CONTENTS 1. SCOPE . 2 1.1 Purpose 2 1.2 Background 2 1.3 Limitations 3 2. REFERENCES . 3 2.1 Applicable Documents . 3 3. DEFINITIONS and acronyms . 3 3.1 Definitions 3 3.2 Acronyms . 4 4. HAZARD ANALYSIS

3、 AND RISK ASSESSMENT (HARA) 6 4.1 Identification of Hazards. 6 4.2 Risk Assessment 8 4.3 Relationship between Safety Goals and Safe States 15 5. NOTES . 15 5.1 Marginal Indicia 15 Appendix A Vehicle level motions . 16 Appendix B Severity CLassification Guidance 17 Appendix C Examples and GUIDANCE fo

4、r Steering function HARA 21 Appendix D Examples and GUIDANCE for Propulsion and Driveline functions Hara 25 Appendix E Examples and GUIDANCE for Suspension functions HARA . 42 Appendix F Examples and GUIDANCE for Brake it is enough to consider vehicle operational situations that are representative a

5、nd include those that lead to the highest ASIL. 4.2.2 STEP 2 - SEVERITY DETERMINATION 4.2.2.1 General Information In accordance with ISO 26262:2011 1, the Severity class of the potential harm caused by a particular hazardous event is assigned to one of four levels as shown in Table 5, below. These S

6、everity classes are general categories presented for guidance in assigning the ASIL for a given hazardous event. A Severity class cannot in general be assigned deterministically because the severity of outcome for any actual collision is dependent on a number of factors, many of which cannot be dete

7、rmined in advance. Factors affecting severity may include: 1. Type of collision such as planar (for example head on, rear end, side impacts) 2. Relative speed between collision participants or at the time of single vehicle events 3. Relative size, height, and structural integrity of the vehicle(s) i

8、nvolved (i.e., crash compatibility) 4. Health and age of vehicle occupants and non-occupants exposed to collision forces 5. Use or not by vehicle occupants of safety protection equipment (e.g., seat belts, child restraints) 6. Availability and response of qualified, rapid emergency assistance (first

9、 aid teams) Of these factors, it may be possible to project some collision characteristics and, in some cases, to project an estimated relative speed of collision. Most of the other factors that may influence the severity of injury outcome cannot be reasonably predicted in advance for a postulated h

10、azardous event. The factors above are considered to the extent practical as a part of determining the Exposure and the Controllability factors used during risk assessment. In all but the most negligible collisions, the possibility of injury, including fatality, is never equal to zero. The characteri

11、stics that may influence injury potential are extremely diverse for all road users, which include both motorists (motorized vehicle drivers and passengers) and non-motorists (e.g., pedestrians and pedalcyclists). Persons involved in traffic collisions range from young, healthy individuals that may b

12、e able to tolerate considerable collision force without sustaining significant injuries to elderly, infirm individuals who may be susceptible to major injuries even in minor, low speed collisions. As a result, the outcome of almost any collision type consists of a distribution of outcome likelihoods

13、 ranging from property damage without injuries to fatalities. SAE INTERNATIONAL J2980 Issued MAY2015 Page 12 of 53 Table 5 provides the ISO 26262:2011 1 description of the S0-S3 Severity classes. Table 5 - Severity class description per ISO 26262:2011 1 Severity Class Description S0* No Injuries S1

14、Light however, inherent limitations preclude precise projections relevant to future experience. For vehicle crash-based scenarios, ISO 26262-3:2011 1 conceptualized a severity classification based on injuries to crash-involved persons (see Table B-1). The Abbreviated Injury Scale (AIS), which assign

15、s a severity score from 1-6 to an individual injury, is referenced and a “probability of injury” at certain AIS levels was conceptualized (in Annex B of ISO 26262:2011) as an illustration for assigning the S0-S3 Severity classes in ISO 26262-3:2011 1. The AIS for injuries sustained by some or all ro

16、ad users involved in traffic crashes within a defined geographic location is available in some historic accident databases. These collections of accident data are typically small samples with case selection criteria that vary by location. Appropriate use of injury rates from available accident datab

17、ase(s) must account for the inherent limitations of the data source; use of accident data to support a Severity class assignment requires an adequate understanding of the collection practices and limitations of the available data to ensure that suitable methodologies are employed and that the result

18、s are appropriately interpreted. Generally, literature reviews and analyses of various global real-world crash databases illustrate the principle that crash severity generally increases as delta v increases. As such, higher travel speeds might increase the likelihood for collisions at higher delta v

19、 resulting in an elevated injury potential. However, there may be a wide variation in any consideration of speed ranges for the S0-S3 assignment based on different historic accident data sources and the specific crash selection criteria. These variations may be attributed to regional differences in

20、the traffic environment, variations in the accident sampling criteria for the historic data, as well as consideration of available collision characteristics, collision partner, occupant restraint fitted or used, and other factors. Technical and practical considerations for the use of historic accide

21、nt data, available through literature reviews or specifically developed analyses, to support Severity class assignment include: Case sampling criteria and data collected vary globally for in-depth accident databases. Differences in analytic findings from different databases may be attributed, in par

22、t, to variations in the sampling criteria. Sample sizes should be considered to better understand the uncertainty based on the accident sampling process, which varies for each available database. In particular, the low frequency of the highest injury severity crashes in available in-depth accident d

23、atabases may constrain any injury classification developed to support a Severity assignment. Selection of the population of interest (level of analysis). For a given set of crashes, injury rates based on the highest recorded injury severity for the crashes, for the involved vehicles, for the involve

24、d road users, and for the involved vehicle occupants will likely be different. That is injury rates of a particular severity computed at the crash, vehicle, or occupant level typically are different for any specific set of crashes. Per ISO 26262-3:2011, 7.4.3.2 Note 1, the Severity classification sh

25、ould consider the injuries potentially sustained by all involved participants in an accident. SAE INTERNATIONAL J2980 Issued MAY2015 Page 18 of 53 Many data elements collected post-crash that may correlate with injury risk are not available pre-crash, so the applicability of these elements in a pre-

26、crash environment is limited. Examples include occupant characteristics (e.g., the oldest occupants will generally have higher injury risk than younger occupants in similar crashes) and collision partner characteristics (e.g., crash energy potential will vary for an un-laden, large commercial vehicl

27、e compared with the same vehicle with maximum load). Post-crash estimates of crash energy (e.g., delta v, barrier-equivalent speed) are: null Not necessarily computed for every vehicle (e.g., no delta v estimate is available in the current sample of US tow away crashes if the collision partner is a

28、medium/heavy truck); null Not necessarily the same as occupant crash pulse, which may be affected by specific collision characteristics, vehicle structure and interior, occupant kinematics, the restraint system, etc.; null Not necessarily the same as or even close to, the pre-crash travel speeds. If

29、 a user of this Recommended Practice has access to specific data or information (for example, data/information that is vehicle-specific or specifically relevant to a future application), perhaps derived from simulation or testing or another method of estimating severity associated with a particular

30、hazard, such data/information could be used. In addition, the presence of another safety system(s) on a vehicle (i.e., in addition to the system that is the subject of the HARA in question) can reduce the potential for harm, and thus may also be factored into a particular Severity class assignment,

31、as well as the related Controllability class. Therefore, the general guidance provided in this informative Annex is intended to support the user to understand the complexity of the topic and make an appropriate decision where further expert analysis is needed. SAE J2980 does not recommend or endorse

32、 a specific method for assigning a Severity class as part of generating a HARA. In the absence of specific, implementable direction from ISO 26262:2011 1, literature reviews and analyses of historic accident databases that include post-crash reconstructed delta v and injury coded to the AIS were con

33、ducted. For Table B-1, information such as the following was taken into account: plane of damage, Maximum Abbreviated Injury Scale (MAIS) of injured participants, direction of the impact force, collision partners, and use of occupant restraints. General guidance for review of the injury rates was in

34、terpreted from ISO 26262-3:2011, Annex B Table B.1 Examples of Severity classification. A summary of the speed ranges based on post-crash delta v estimates from these various analyses and reviews are provided in Table B-1. Although injury rates generally increase as impact speed increases, there is

35、a wide variation in the speed ranges for the S0-S3 assignment depending on the data source and crashes considered. Although the speed ranges from these analyses were based on delta v from post-crash reconstruction, these ranges may provide some general initial guidance for S0-S3 assignment; however,

36、 use of the following Table B-1 is not required as part of the SAE J2980 Recommended Practice. To obtain a set of discrete ranges, the analyst may select only one source of data, and apply interpretation including appropriate selection criteria and Severity criteria. Following this procedure, the re

37、sulting speed ranges to assign the Severity classes will not overlap. SAE INTERNATIONAL J2980 Issued MAY2015 Page 19 of 53 Table B-1 - Minimum and maximum speed ranges (delta v) from various analyses of global accident databases Collision Type Range For S0 S1 S2 S3 Front Minimum speed 4-10 kph, and

38、20-50 kph, and 40-65 kph Maximum speed 4-10 kph , and 20-50 kph, and 40-60 kph Maximum speed 2-10 kph, and = 8-30 kph, and 16-40 kph Maximum speed 10% probability of AIS 1-6 (and not S2 or S3) S2: 10% probability of AIS 3-6 (and not S3) S3: 10% probability of AIS 5-6 B.2 EXAMPLE OF ANALYSIS USED FOR

39、 TABLE B-1: GIDAS DATABASE GIDAS (German In-Depth Accident Study) 4 is a project started in 1999 to gather accident data involving personal injury in two of Germanys metropolitan regions (Hannover and Dresden). Each year approximately 2000 accidents are recorded and added to the database. The in-dep

40、th study includes on-the-scene documentation, interviews with involved persons, and data gathered from police, hospitals and rescue teams. In addition, each accident is reconstructed to determine additional parameters. Up to 3000 parameters are determined for each accident (further information is av

41、ailable at 4). Use of these data as a basis for Severity classifications in a HARA requires attention to several points of caution: Although the accidents are sampled according to a well-defined method there is some bias compared to national statistics, which can be compensated for by standardized a

42、nd published weighting methods. The database contains data starting from 1999. The use of these data to determine accident severity for a car that is still under development therefore needs to consider advances in active and passive safety and improvements in road infrastructure that have occurred i

43、n the meantime. One possible way to factor in such advances may be to consider only recent model years or cars fitted with certain systems (e.g., ABS, ESC, curtain airbag, pedestrian protection). SAE INTERNATIONAL J2980 Issued MAY2015 Page 20 of 53 A given hazardous situation could lead to a range o

44、f possible accident scenarios. The analyst should refrain from detailed analysis that is only possible a posteriori but cannot be predicted in a HARA. Table B-1 incorporates analysis of GIDAS data consistent with the general methodology described above. NOTE: The GIDAS data has been normalized befor

45、e use to extrapolate the personal injury statistics to match the statistics expected on a national basis. B.3 VARIATION IN TABLE B-1 In addition to GIDAS, the entries in Table B-1 were compiled from proprietary analysis conducted using available accident databases from France, Japan, and the U.S. Th

46、e French data was from Laboratoire dAccidentologie et de Biomcanique. The data was collected based on crashes occurring on cars built in 1990 or later, for which an AIS determination was available. Every injured person was considered in this analysis, whether they were adequately restrained or not,

47、since it is representative of the actual usage of the vehicle. The considered accidents were classified according to the crash direction (front, side, rear). The French data analysis was complemented with expert judgment for some situations (e.g., pedestrian crashes). The Japan data was from the Ins

48、titute for Traffic Accident Research and Data Analysis (ITARDA) 5. The data are a census of police investigations of all fatal and injury crashes, as well as driver licenses and vehicle registration data. For a subset of the accidents, ITARDA also includes in-depth investigations. Further informatio

49、n is available at 5. The U.S. data was from the National Automotive Sampling System Crashworthiness Data System (NASS/CDS), which includes retrospective in-depth investigations of a multi-stage stratified sample of police-reported crashes with at least one towed light vehicle (GVWR 4,536 kgs). The NASS/CDS limitations include: injury information is available only for light vehicle occupants (and only for vehicles 10 years old and newer since 2009), and delta v is not available for all collision partners (e.g., medium/heavy truck). Furt