Automotive
Development of control units and vehicle software, from concept to release
Electrics, electronics and software determine a large part of vehicle functions, from electric mobility and driver assistance to infotainment. A control unit emerges from the interplay of requirements, system architecture, hardware, software and testing, at manufacturers as well as at automotive suppliers, for cars, trucks and buses.
Fixed requirements apply to this development. ISO 26262 governs functional safety, ISO/SAE 21434 and UN R155 cybersecurity, and Automotive SPICE the maturity of processes. Customers ask about them as soon as a control unit is due to go into series production.
Which requirements apply in vehicle development
Standards and regulations to be met for control units and vehicle software.
Functional safety
ISO 26262 starts from the vehicle function: a hazard analysis and risk assessment (HARA) sets the ASIL rating from A to D and the safety goals. For hazards without a fault, such as sensor limits in driver assistance, ISO 21448 (SOTIF) applies as well.
More on functional safety →Cybersecurity
ISO/SAE 21434 requires a threat analysis and risk assessment (TARA) and cybersecurity requirements across the whole life cycle, down to handling vulnerabilities in the field. UN R155 requires a cybersecurity management system (CSMS) for type approval; UN R156 and ISO 24089 cover software updates.
More on cybersecurity →Process maturity
Automotive SPICE rates in levels how well the processes for system requirements, software development, testing and project management are defined and practised. Many customers require a minimum level for awarding contracts.
More on process maturity and interfaces →When support makes sense
Typical triggers in vehicle development.
Safety concept missing
A control unit with a safety-related function is due to go into series, but the ASIL rating is not settled and the safety concept is missing.
Component is reused
An existing component is to be used in another vehicle, and the assumptions for its use are not documented.
Evidence for type approval
The manufacturer asks for cybersecurity management evidence under UN R155, and the supplier has not settled who assesses vulnerabilities in the field.
Assessment announced
A customer's Automotive SPICE assessment is coming up, and requirements, architecture and tests are not traceable end to end.
What we take on in vehicle development
Three service areas that can be combined as the task requires.
Engineering
Item definition, requirements and system architecture for vehicle functions, plus safety and security concepts at system level and a feasibility assessment before the decision.
More →Management
Safety and security management in the project with a safety plan and a cybersecurity plan, quality and process management to Automotive SPICE, and coordination between customer and suppliers.
More →Development and testing
Safety analyses such as FMEA, FTA and FMEDA, verification and validation to ISO 26262, and cybersecurity testing through to release.
More →Approach and work products
The work follows four steps.
Define item and scope
Function, system boundaries and interfaces are defined and the applicable standards named, depending on whether the role is manufacturer or supplier.
Assess hazards and threats
The HARA sets ASIL and safety goals, the TARA the cybersecurity goals. Assumptions are documented.
Derive concepts and requirements
The goals lead to the safety and cybersecurity concepts and the technical requirements, with ASIL decomposition where needed.
Show the evidence
Safety case, verification reports and process evidence are prepared so that customers and assessors can follow them.
This produces, among other things, the item definition, the hazard analysis and risk assessment, the safety concept, the threat analysis and risk assessment, the cybersecurity concept, traceability from requirements to test, and a process assessment with an action plan. An independent assessment or certification is not part of it.
Frequently asked questions
Which standard applies to my control unit?
That depends on the function. Safety-related functions fall under ISO 26262, connected functions under ISO/SAE 21434 and UN R155, and development processes are often assessed to Automotive SPICE. The extent is clarified at the start.
What is the difference between ISO 26262 and ISO/SAE 21434?
ISO 26262 looks at hazards caused by faults in the system, ISO/SAE 21434 at threats from outside attacks. Both require analyses and evidence that overlap and should be aligned so that nothing is done twice.
What does ASIL mean, and how is it set?
ASIL (Automotive Safety Integrity Level) is the rating in ISO 26262 from A to D, where D has the highest requirements. It results in the HARA from the severity, exposure and controllability of a hazard.
Does ISO 26262 also apply to trucks and buses?
Yes, the 2018 edition includes trucks and buses and applies to series-production road vehicles with the exception of mopeds.
When does a supplier need a cybersecurity management system?
UN R155 obliges the vehicle manufacturer. In practice, manufacturers pass the requirements on to their suppliers, who then have to show processes to ISO/SAE 21434 and the handling of vulnerabilities.
What changes with Automotive SPICE 4.0?
Version 4.0 adds process areas for cybersecurity, hardware engineering and machine learning, among others, and revises the assessment. For ongoing projects it has to be clarified which version the customer applies.
Clarify your project in a call
In the call we clarify the trigger, which standard applies and which deadline has to be met.