The vocabulary, in plain terms

The integrity target ISO 26262 assigns to a hazardous event, from A to D, with QM meaning no safety requirement applies. It falls out of three classifications of the hazard rather than being chosen: how badly someone could be hurt, how often the vehicle is in that situation, and how likely a driver is to avoid the harm. D is the most demanding.

Splitting one high-integrity requirement across two channels that each carry a lower integrity, so that neither alone has to reach the top level. The arithmetic is the easy half. The work is arguing that the two channels cannot fail together, which is where freedom from interference has to be demonstrated rather than assumed.

The ISO/SAE 21434 counterpart to ASIL: how much rigour a cybersecurity control needs, derived from the impact of the threat scenario and how feasible the attack is. Unlike ASIL it does not propagate through a decomposition rule, so it is applied per control.

The share of a component's dangerous failures that a safety mechanism detects. It is claimed per mechanism and it is the single number with the most leverage over the hardware metrics: moving a claimed DC by one point moves SPFM, LFM and PMHF together.

The contract annexe that names which safety work products each party produces, reviews and approves when development is distributed. It exists so that a gap between two suppliers is discovered at kick-off rather than at assessment.

Per-message protection that travels with the data rather than with the bus: a counter, a data identifier and a checksum, checked by the receiver. It catches a corrupted, repeated, lost or stale frame regardless of what happened between the two ECUs.

One failure per billion hours of operation. Component failure rates and hardware metrics are expressed in FIT because the numbers involved are otherwise unreadable: an ASIL D target of 10 FIT is 10 × 10^-9 failures per hour.

The parts-level analysis that produces the hardware metrics. For each element you record its failure rate, how much of that rate is harmless, which mechanism covers the rest and how well. SPFM, LFM and PMHF are outputs of that table, not inputs to it.

The time available between a fault occurring and the hazard happening, which is the budget every detection and reaction step has to fit inside. The statistical distribution of your reaction time is context; the deterministic upper bound is what the safety argument rests on.

The first analysis in a safety programme. It identifies what the item could do that hurts someone, classifies each hazardous event, and derives the safety goals that everything downstream traces back to. A safety case whose goals cannot be traced to a HARA has no foundation.

The share of faults that would otherwise sit undetected until a second fault makes them dangerous. It measures how well the design finds faults that are not immediately harmful, which is why it is the metric that punishes weak start-up and periodic testing.

A structural coverage criterion where every condition in a decision must be shown to independently affect the outcome. ISO 26262 expects it for software at the highest integrity level. Line coverage is not a substitute and branch coverage is only an approximation of it.

The smallest combination of basic events that on its own causes the top event. A cut set of order one is a single point of failure; higher orders only matter in combination, and how much they matter depends on how long the first fault can sit latent.

A coding guideline set that restricts C to a subset whose behaviour is predictable, avoiding the parts of the language that are undefined, unspecified or simply easy to get wrong. Deviating from a rule is allowed and normal; deviating without a recorded rationale is the finding.

The residual rate at which random hardware failures violate a safety goal, in FIT. It is one of two hardware criteria at ASIL D and, in practice, usually the easier of the two: the single-point fault metric tends to bind first.

The OMG standard for moving requirements between tools with their attributes, structure and hierarchy intact. It is how requirements leave Polarion, codebeamer or DOORS without being retyped, and supporting it is usually the difference between a tool being evaluated and not.

The identifier under UN R156 that ties a type-approved configuration to the software versions in it. If an update changes something the approval depends on, the RXSWIN changes and the approval has to be revisited before the campaign ships.

The condition an item moves to when it can no longer be trusted to operate normally. For a traction inverter that is usually active short circuit or open-phase rather than simply switching off, because the wrong choice at speed creates a different hazard.

AUTOSAR authentication for bus messages: a truncated message authentication code plus a freshness value, so a receiver can tell a genuine frame from a replayed or forged one. The cost is bus load and verification latency, and both have to fit inside the FTTI.

A component developed to a safety integrity level without knowing the item it will end up in. Its assumptions of use are written down in a safety manual, and integrating it means checking that your system actually satisfies them.

Hazards that arise when nothing has failed: the sensor was working, the algorithm did what it was designed to do, and the outcome was still unsafe because the situation was outside what the design anticipated. It is the standard that matters most for perception and for machine learning.

The share of a hardware element's failure rate that cannot cause a safety goal violation on its own, either because it is harmless or because a mechanism catches it. At ASIL D it is normally the binding constraint, tighter than PMHF.

The ISO/SAE 21434 counterpart to a HARA. It identifies threat scenarios against assets, rates their impact and attack feasibility, and drives the decision to reduce, share, retain or avoid each risk. UN R155 type approval depends on it existing and being maintained.

The argument that a tool used in a safety programme will not silently introduce or fail to detect an error. A tool is classified by how much it could go wrong and how likely you are to notice, and the confidence level that results decides how much evidence you owe.

The UNECE regulations that make a cybersecurity management system and a software update management system conditions of type approval in the markets that adopt them. They are why a TARA and an RXSWIN scheme stopped being optional.

A statement attached to an SBOM saying whether a known vulnerability in a listed component is actually exploitable in this product, and why. It is what stops a CVE feed from generating a hundred alerts for code that is compiled out.