FuSaCert · Functional safety learning
HARA and ASIL: an unintended propulsion worked example
HARA begins by defining the item, malfunctioning behaviour and operational situation, rather than selecting an ASIL first. This simplified example follows unintended positive propulsion when the driver requests deceleration.
This is an original explanation based on the concept-phase structure of ISO 26262-3:2018. The vehicle, scenario and S/E/C ratings are teaching assumptions, not a safety assessment of a real vehicle or system.
1. Define the item and malfunctioning behaviour
Teaching item: a control function providing positive vehicle propulsion in response to driver requests. The simplified boundary covers request inputs, propulsion control and output interfaces. Actuators, vehicle dynamics and interactions with other systems need to be completed in a real item definition.
Malfunctioning behaviour: unintended positive propulsion continues when the driver requests deceleration. This describes a deviation from intended functionality without presupposing a particular sensor, software defect or hardware fault as its cause.
2. Place the hazard in an operational situation
Teaching situation: a vehicle follows another vehicle on a road and must decelerate to maintain separation. Unintended positive propulsion makes safe separation difficult, potentially causing a collision and injury.
Unintended propulsion describes the malfunctioning behaviour. The potential source of harm associated with vehicle motion concerns the hazard. Combining it with the following-traffic situation produces the hazardous event to assess. Speed, distance, road conditions and affected people change the analysis conditions.
3. State S/E/C assumptions and evidence needed
This deliberately high-risk teaching combination demonstrates the chain from classification to a safety goal. It does not establish the same rating for this function in every situation.
| Dimension | Teaching assumption | Reason for the assumption | Evidence needed in a real project |
|---|---|---|---|
| Severity S | S3 | Assume that the collision can cause life-threatening or fatal injury. | Collision conditions, speed, affected people and injury analysis. |
| Exposure E | E4 | Assume high exposure to the relevant following-traffic operational situation. | Vehicle use and operational situation data, not controller failure probability. |
| Controllability C | C3 | Assume that affected people have difficulty avoiding harm after the hazardous event develops. | Driver response, available controls, situational constraints and analysis or test evidence. |
Only under the teaching assumptions above
S3 / E4 / C3 → ASIL D
Table lookup, not a universal rating for real vehicles
4. Connect risk classification to a safety goal
For this teaching combination, Part 3 Table 4 gives ASIL D. ASIL comes from the classification table; S, E and C are not numbers to multiply together.
Draft teaching safety goal: prevent unintended positive propulsion that leads to this hazardous event under the specified operating conditions when the driver requests deceleration. The goal carries this example’s ASIL D and requires refinement through a complete HARA in a real project.
The subsequent functional safety concept needs safety behaviour, allocation, applicability and timing constraints. No vehicle data is available here, so the example does not invent a safe state, fault tolerant time interval (FTTI) or braking capability.
5. Three common mistakes
Treating E as failure probability
Ask how often the vehicle is in the relevant operational situation before judging exposure. A chip failure rate is not the exposure input.
Reducing initial risk using a future safety measure
Planning to add monitoring is not sufficient reason to reduce these example ratings. Follow the standard’s analysis boundaries and assumptions, and state the conditions for measures considered.
Recording a rating without its rationale
S3/E4/C3 labels the conclusion. Reviewable situation definitions, evidence and treatment of uncertainty explain why the judgement was made.
Common questions
- Why can the same function have different ASILs?
- A hazardous event combines a hazard and an operational situation. Classification can change with the situation, potential harm and controllability. A function name alone does not establish a universal rating.
- Does QM mean no work is needed?
- QM indicates that this classification does not yield an ASIL. It does not mean the product is risk-free or that normal quality management can be omitted. Other hazardous events need separate analysis.
- Can FMEA replace HARA?
- Their focus differs. HARA examines hazardous events arising from item malfunctioning behaviour in operational situations. FMEA systematically examines failure modes and effects of an analysed object. It can support further analysis but does not replace a complete HARA.
Sources and scope
- ISO 26262-3:2018 · ISO catalogue
Paraphrase basis: Clause 5 item definition; Clause 6 HARA, particularly 6.4.3 classification, Table 4 ASIL determination and 6.4.4 safety goals. Ratings and safety-goal wording are teaching examples.