norxs · ISO 26262 Safety Dashboard

Open ASIL-D Items

Requires immediate action

▲ +1 since last sprint

⚠

Safety Goals

6 allocated · 1 pending

▼ 2 closed this week

◉

SPFM (Target ≥99% · ASIL D)

Inverter subsystem · Part 5

▲ +0.6% this revision

✓

Work Products

40 / 55 approved

▲ 6 approved this week

📋

Hazard Analysis & Risk Assessment (HARA)

ISO 26262 Part 3 → Fault Tree

ID	Hazardous Event	Operational Situation	S	E	C	ASIL	Status
H-01	Unintended vehicle acceleration	Driving, all speeds & road conditions	3	4	3	ASIL D	In Review
H-02	Loss of traction control (high speed)	Highway driving, incl. low-µ surface	3	4	3	ASIL D	Open
H-03	BMS overcurrent — thermal runaway	DC fast charge / high-load driving	3	3	3	ASIL C	In Review
H-04	Regen braking loss at high SoC	Downhill descent, SoC > 95%	2	3	3	ASIL B	Verified
H-05	HV contactors fail to open on crash	Post-crash (severe frontal impact)	3	2	3	ASIL B	Closed
H-06	Incorrect SoC display (>15% error)	Long-distance driving, range planning	1	3	3	ASIL A	Closed
H-07	Charging port lock failure	AC charging, vehicle stationary	0	3	1	QM	Closed

ASIL Classification Matrix

S × E × C

CONTROLLABILITY →

@ E4

↑ SEVERITY

Values shown at E4 (highest exposure). Per ISO 26262-3 Table 4, each exposure step below E4 reduces the ASIL by one level (D → C → B → A → QM).

ASIL Distribution

ASIL D2 items

ASIL C1 item

ASIL B2 items

ASIL A / QM2 items

HARA Risk Matrix

Severity × Exposure · ISO 26262 Table 4 · C3 worst-case

EXPOSURE →

← Severity

E1
Rare

E2
Low

E3
Probable

E4
Frequent

S3
Fatal

H-05

H-03

H-01H-02

S2
Severe

H-04

S1
Moderate

H-06

S0
None

H-07

LEGEND

ASIL A

ASIL B

ASIL C

ASIL D

7 hazards plotted at assessed S/E
Dot colour = assigned ASIL
Cell shading = ASIL at C3

ASIL Decomposition — SG-01

ISO 26262-9 §5

SG-01 · ASIL D

Prevent unintended torque > 2 Nm

FTTI: 100 ms · Safe state: torque-off (ASC)

→ D = B(D) + B(D)

TSR-01.1a · ASIL B(D) · Inverter MCU (SW)

Torque plausibility check, 10 ms reaction

TSR-01.1b · ASIL B(D) · FPGA PL (HW)

Independent resolver monitor with LoS detection, 5 ms

Independence confirmed via DFA-EV700-03 (dependent failure analysis): separate silicon, separate supply rails, no shared clock domain. Both decomposed elements verified to ASIL D integration requirements per ISO 26262-9 §5.4.

FMEDA Snapshot

Part 5 · HW

Component

Failure Mode

λ FIT

Class

λ_res

Inverter MCU

Core / RAM fault

210

98%

SPF/RF

4.2

Gate Driver

Stuck-on

95%

SPF

2.2

Current Sensor

Offset drift >2%

95%

0.9

HV Contactor

Fail to open

90%

MPF-L

LFM

Temp Sensor

Open circuit

90%

MPF-L

LFM

SPFM (target ≥99%)99.2%

LFM (target ≥90%)92.5%

PMHF (target <10 FIT)7.3 FIT

PMHF What-If — adjust DC

MCU98.0% Gate Drv95.0% Sensor95.0%

PMHF = Σλ(1−DC) 7.3 FIT · PASS

Snapshot covers top-3 PMHF contributors. SPFM/LFM derive from the full FMEDA (1,240 rows).

Zone Communication

E/E Architecture

Zone 1

Front Powertrain

ECUs: 4

CAN FD: 2 Mb/s

ASIL D SecOC + E2E P7

Zone 2

Rear PT & BMS / HV

ECUs: 5

Eth + ISO-SPI

ASIL D SecOC + MACsec

Zone 3

Body & Cabin

ECUs: 6

VLAN: Segregated

QM CCG firewall

Zone 4

ADAS & Sensors

ECUs: 6

Eth: 1GBASE-T1

ASIL B MACsec 802.1AE

E2E Coverage — Safety PDUs100%

SecOC — Powertrain CAN FD100%

SecOC — Vehicle-wide88%

Latency Budget Compliance100%

Project Lifecycle (V-Model)

ISO 26262 Part 2

Phase 1

Item Definition & SEooC

Completed — Rev 3.1 approved

Phase 2

HARA & Safety Goals

Completed — 7 SGs defined

Phase 3 — Active

FSC / Technical Safety Concept

1 of 7 FSRs pending allocation

Phase 4

SW / HW Architecture Design

Starts Q3 2026

Phase 5

Integration & Safety Validation

Target: Q1 2027

Work Products

2 pending review

📄

Safety Plan

v3.2

✓

📄

HARA Report

v4.0

✓

📄

Functional Safety Concept

v2.1 · DRAFT

⚠

📄

FMEDA — HW Architecture

v1.8 · DRAFT

⚠

📄

DFA Report

v1.4

✓

norxs · ISO 26262 Safety Platform · Demo environment — simulated data · norxs.com

Last sync: