Can safety standards handle the speed of research in the car industry?

In lights of the upcoming 6th International Conference ISO 26262, Automotive IQ sat down with Helen Monkhouse, MISRA Steering Committee Member, SAE Functional Safety Committee Member and Protean Electric Product Safety Manager, to discuss the speed of research in the car industry and how the ISO standard is keeping up. Ms. Monkhouse, how do the MISRA guidelines help to ensure that managers have suffi-cient information to make important functional safety decisions?

The MISRA, the Motor Industry Software Reliability Association, is a collaboration between vehicle manufacturers, component suppliers and engineering consultancies in the UK. It seeks to promote best practice in the development of safety related electronic systems for road vehicles. As such, our aim has always been to publish guidelines that describe the current best practice in a given area. Because of the origins of MISRA, all the guidelines published have had an automotive focus, but as guidelines like MISRA C have demonstrated, the material is relevant to the wider uses of practitioners outside of the automotive industry. We hope that the new MISRA Safety Case guidelines will continue that tradition of providing tool agnostic relevant material for the developers of safety related systems.

What progress has been made in 2015 in the MISRA Safety Case Working Group and what is the outlook for 2016?

I think it’s fair to say that our ideas and concepts relating to the best practice for developing safety cases for the automotive industry are largely static now. We haven’t had any "Eureka moments" within the group in the last few months, and really since the middle of 2015 our focus has been writing up the ideas and concepts to a publishable standard. Our first internal draft is nearing completion, and we anticipate finishing that first draft at our next face-to-face meeting in January 2016. Once we’ve got the draft complete, our process will then be to carry out an internal review before then sending the document out for a wider public review. Luckily, during the last two ISO 26262 conferences a number of people have put their hands up and volunteered to review the guidelines, so we’ll be contacting those people in the near future!

What is the timelines for publishing that draft?

I would be hopeful that it is the end of next year. However, from previous experience writing standards and guidelines does seem to be quite a long process. And one thing we must do is to make sure that the content of this guideline is of the same calibre as previous MISRA guidelines. So I think it will probably be towards the end of next year when we’re able to publish something.

[inlinead]

MISRA isn’t running certification schemes and it does not endorse specific products. Why not?

It’s not the aim of the group at all. Really coming from the origins of MISRA, being a collaboration of manufacturers, suppliers and consultancies, we didn’t want to a) get involved in certification schemes or b) to be seen to be endorsing any specific products. Our mission statement is very much about trying to develop the best practice within the industry for development of safety-related systems, and we wanted to do that without running a certification scheme or endorsing any particular products.

The work on the next edition for ISO 26262 is ongoing. What are the priorities for the UK delegation?

I can’t really speak for the UK delegation as a whole, but from my perspective the priority is to ensure the safety-lifecycle process described by ISO 26262 remains coherent moving forwards, because when you look at the additions to the standards, it has a much broader scope, and it also incorporates some of the previously published Publicly Available Specifications. So I think the challenge really will be to incorporate all the new material in a meaningful way. That will either be by weaving the new material into the existing ten parts, or in some cases that could be by creating new parts to the standard as well.

Regarding the trend towards autonomous driving, many argue that the ISO 26262 standard is insufficient. Do you agree and what are the consequences for car makers?

I think that greater automation brings many challenges. For example the risk model of ISO 26262 assumes that the driver is a part of the control loop. The driver’s ability to maintain control is a fundamental consideration when we determine hazard risk. Obviously, greater automation has the potential to take the driver out of the control loop, and the impact that this might have on a driver’s ability to regain control is the subject of a lot of current research.

The question of ISO 26262 being sufficient or rather insufficient seems to depend on what people expect from the standard…

Some view ISO 26262 as the standard to address only the malfunctioning behavior of the item, while others view ISO 26262 as an 'all encompassing" system safety standard. If you hold the former view then ISO 26262 remains sufficient, because you would probably look to other standards for guidance regarding the ADAS functionality. However, if you hold the latter view then you might be looking for ISO 26262 to say more; particularly regarding topics like 'failure of the intended function.' Given that safety is an inherent property of a system I believe that safety should be considered right at the beginning; while the vehicle feature is still at the conceptual research phase. However, existing organizational structures might make this a challenge for many companies.

Autonomous driving features are evolving quickly. Taking TESLA as an example, they’ve just rolled out an autopilot system for one of their models. And more car makers and brands are expected to follow this trend in the near future. Can the ISO standard handle and keep up with the speed of research in the car industry?

No, it probably isn’t on track. It’s very difficult to see how the two can keep in step. My understanding is that there’s a particular update schedule for international standards like ISO 26262 which does in a way limit the speed of change that you can make to the documentation. It is always going to be a challenge, not just for the ISO functional safety standard, but also for other regulations to do with ADAS functionality. The legislation and standards are going to struggle to keep pace with the technology change.

Your main occupation is with Protean Electric – a tech company developing in-wheel motors for electric vehicles. As a global product safety manager yourself, what do you consider to be most important in terms of safety and security during the safety concept phase?

If you look at our in-wheel motor products, you can think of it as a safety element out of context. That’s because from an ISO 26262 perspective, you would think of the item as being an electric driveline system. That would likely consist of two or four in-wheel motors, a vehicle controller and maybe it would also include the battery management system. Therefore, of particular importance to me is the verification of assumptions. During the development of the in-wheel motor, we’ve made a number of assumptions about aspects of the potential customer’s vehicle, all of which need to be verified with the customer to ensure that we do actually have a safety concept that achieves safety at the vehicle level.

With your work at Protean Electric, your involvement with MISRA, SAE and ISO, and now you have started doing research on the controllability and the risk to autonomous vehi-cles at the University of York. You must be a wizard of time management. What’s driving you?

I suppose I have two motivations. The first is to ensure best practice approach to system safety across the industry. That has an added benefit for me of ensuring that my knowledge remains current, and the tools and techniques that I’m deploying within Protean Electric are commensurate with industry best practice. I think my second motivation is much more self-indulgent. Greater automation would appear to break many of the assumptions underlying the ISO 26262 risk model. It would be nice to think that I may identify a method as part of my research that practitioners developing safety-related ADAS features might be able to use in the future.

Finally, what are you presenting at the upcoming ISO 26262 conference and why is this significant to the industry?

I’m presenting two areas: one is the hazard analysis and risk assessment landscape master class. In that talk on the first day, I’ll be incorporating some of the ideas that we’re developing as part of the MISRA safety case working group into a master class. So we’ll be looking at things like how to ensure that all the relevant hazards have been identified and justifying that the safety goals that have been specified do actually reduce the residual risk to an acceptable level. The other thing I’m doing is right at the end of the conference, which is a workshop entitled ‘Autonomous Road Vehicles Hazard Analysis and Risk Assessment of Driverless Cars’. I want to make this workshop an interactive one, which explores the impact that greater automation might have on the ISO 26262 risk model, by inviting delegates to share experiences and perhaps suggest some potential solutions along the way!