Safety Dashboard
PROJECT · EV-700 · BMS / Inverter Domain · ASIL Decomposition Rev 4
Open ASIL-D Items
0
Requires immediate action
—
Safety Goals
0
—
—
SPFM (Target ≥99% · ASIL D)
0
Inverter subsystem · ISO 26262-5
—
Work Products
0
—
—
Hazard Analysis & Risk Assessment (HARA)
ISO 26262 Part 3
→ Fault Tree
| ID | Hazardous Event | Operational Situation | S | E | C | ASIL | Status |
|---|
ASIL Classification Matrix
S × E × CCONTROLLABILITY →
C1
C2
C3
S1
QM
A
B
@ E4
S2
A
B
C
S3
B
C
D
↑ SEVERITY
Values shown at E4 (highest exposure). Per ISO 26262-3 Table 4, each exposure
step below E4 reduces the ASIL by one level (D → C → B → A → QM).
ASIL Distribution
ASIL D2 items
ASIL C1 item
ASIL B2 items
ASIL A / QM2 items
HARA Risk Matrix
Severity × Exposure · ISO 26262 Table 4 · C3 worst-caseEXPOSURE →
← Severity
E1
Rare
Rare
E2
Low
Low
E3
Probable
Probable
E4
Frequent
Frequent
S3
Fatal
Fatal
A
H-05
H-03
H-01H-02
S2
Severe
Severe
QM
A
H-04
C
S1
Moderate
Moderate
QM
QM
H-06
B
S0
None
None
H-07
LEGEND
QM
ASIL A
ASIL B
ASIL C
ASIL D
7 hazards plotted at assessed S/E
Dot colour = assigned ASIL
Cell shading = ASIL at C3
Dot colour = assigned ASIL
Cell shading = ASIL at C3
ASIL Decomposition — SG-01
ISO 26262-9 §5SG-01 · ASIL D
Prevent unintended torque > 2 Nm
FTTI 200 ms · FHTI allocated 100 ms · measured 45 ms
Safe state: active short circuit (ASC)
→ D = B(D) + B(D)
TSR-01.1a · ASIL B(D) · Inverter MCU (SW)
Torque plausibility check, 10 ms reaction
TSR-01.1b · ASIL B(D) · FPGA PL (HW)
Independent resolver monitor with LoS detection, 5 ms
Freedom from interference — DFA-EV700-03: separate silicon,
separate supply rails, no shared clock domain. Both elements developed to the ASIL D integration
requirements of ISO 26262-9 §5.4.
QUALIFYING CONDITION
TSR-01.1a bounds torque from rotor position, which is the signal TSR-01.1b monitors. The branches are physically independent and functionally dependent: a resolver fault that TSR-01.1b misses feeds a wrong envelope to TSR-01.1a. The decomposition therefore holds only while TSR-01.1b is effective, and that dependency — not the silicon separation — is what the DFA has to close. Carried as an open item rather than argued away.
TSR-01.1a bounds torque from rotor position, which is the signal TSR-01.1b monitors. The branches are physically independent and functionally dependent: a resolver fault that TSR-01.1b misses feeds a wrong envelope to TSR-01.1a. The decomposition therefore holds only while TSR-01.1b is effective, and that dependency — not the silicon separation — is what the DFA has to close. Carried as an open item rather than argued away.
FMEDA Snapshot
Part 5 · HWComponent
Mechanism
λ FIT
DC
Class
λres
SPFM (target ≥99%)—
LFM (target ≥90%)—
PMHF (target <10 FIT)—
PMHF What-If — adjust DC
MCU—
Gate Drv—
Sensor—
SPFM — · LFM —
— FIT · —
Sliders move the claimed single-point DC of three real parts; the full 12-part FMEDA is recomputed, so SPFM, LFM and PMHF stay consistent with each other.
Which assumption is most fragile
How far each input can move before an ASIL target fails. Solved against the same engine that draws the metric, not from a derivative.
Run this on your own FMEDA
ISO 26262-5 · in-browserLoad a parts list and the architectural metrics are recalculated from it. The file is parsed in this browser and is never uploaded — a hazard analysis is exactly the document you cannot hand to a supplier’s web service.
Drop a CSV or JSON file here
or click to choose · columns: id, name, lambdaFit, safeFraction, mechanism, dcSpfPct, dcMpfPct
SPFM
—
target ≥ 99 %
LFM
—
target ≥ 90 %
PMHF
—
target < 10 FIT
Σλ
—
parts: 0
Evidence package & baselines
reproducible · SHA-256The package holds the hazard analysis, the FMEDA and its computed metrics, the minimal cut sets and the traceability rows, serialised in a key-sorted canonical form. Re-running over unchanged inputs on the same build reproduces the same hash, so a reviewer compares one string instead of diffing a document. Baselines are kept in this browser’s own storage.
content SHA-256
computing…
| Baseline | Saved | SPFM | PMHF | Change vs now |
|---|
Zone Communication
E/E ArchitectureZone 1
Front Powertrain
ECUs: 4
CAN FD: 2 Mb/s
ASIL D
SecOC + E2E P7
Zone 2
Rear PT & BMS / HV
ECUs: 5
Eth + ISO-SPI
ASIL D
SecOC + MACsec
Zone 3
Body & Cabin
ECUs: 6
VLAN: Segregated
QM
CCG firewall
Zone 4
ADAS & Sensors
ECUs: 6
Eth: 1GBASE-T1
ASIL B
MACsec 802.1AE
E2E Coverage — Safety PDUs100%
SecOC — Powertrain CAN FD100%
SecOC — Vehicle-wide88%
Latency Budget Compliance100%
Project Lifecycle (V-Model)
ISO 26262 Part 2Phase 1
Item Definition & SEooC
Completed — Rev 3.1 approved
Phase 2
HARA & Safety Goals
Completed — 7 SGs defined
Phase 3 — Active
FSC / Technical Safety Concept
1 of 7 FSRs pending allocation
Phase 4
SW / HW Architecture Design
Starts Q3 2026
Phase 5
Integration & Safety Validation
Target: Q1 2027
Work Products
2 pending reviewSafety Plan
v3.2
✓
HARA Report
v4.0
✓
Functional Safety Concept
v2.1 · DRAFT
⚠
FMEDA — HW Architecture
v1.8 · DRAFT
⚠
DFA Report
v1.4
✓
norxs · ISO 26262 Safety Platform · Demo environment — simulated data · norxs.com
Last sync: