FuSaCert · Functional safety learning
ISO 26262 dependent failure analysis (DFA): its link to ASIL decomposition
DFA examines dependent failures that could affect multiple elements and weaken their independence. It is related to ASIL decomposition, but they are separate activities: decomposition is in ISO 26262-9 Clause 5, while DFA is in Clause 7.
This page paraphrases ISO 26262-9:2018 Clauses 5.4.3, 7.4.1, 7.4.2 and 7.4.7 and adds original FuSaCert learning guidance. Consult the applicable standard edition and project reviews.
DFA and ASIL decomposition are related but distinct
ISO 26262-9 places requirements decomposition with respect to ASIL tailoring in Clause 5 and dependent failure analysis in Clause 7. ASIL decomposition describes how requirements are allocated to multiple elements; DFA analyses dependent-failure causes that could undermine their independence.
Clause 5.4.3 links the judgement of sufficient independence to the Clause 7 DFA result: the analysis finds no plausible dependent-failure cause that violates the initial safety requirement, or each identified cause is controlled by a safety measure commensurate with the initial ASIL. Redundancy alone does not establish independence.
A learning exercise for organizing a DFA
Clause 7.4.1 describes deductive and inductive analyses as ways to identify potential dependent failures. Start from the actual architecture and coupling relationships, then explain which causes could affect multiple elements and how they could affect the initial safety requirement.
The steps below are a way to structure study notes, not a complete project process or a ready-to-use checklist.
Define the analysis scope
Record the initial safety requirement, its ASIL, the decomposed elements and their interfaces and shared-resource boundaries.
Identify dependent-failure causes
Use a deductive or inductive approach suited to the architecture. Examine plausible common-cause and cascading failures and record the basis for each conclusion.
Assess effects and controls
Explain whether a plausible cause could violate the initial requirement. If causes are identified, describe the safety measures that control their effects and the ASIL basis.
Revisit changes
When interfaces, resources or deployment change, check whether the coupling analysis and independence argument still hold.
A dependent failure is not always summarized by one number
The note to Clause 7.4.2 says that when random hardware failures must be quantified, the contribution of common-cause and cascading failures is still estimated qualitatively because no general, sufficiently reliable quantitative method exists. Do not insert a fixed percentage or model result without an applicable basis.
DFA conclusions should identify plausible causes, effect paths and measures. SPFM, LFM and PMHF cannot replace DFA; those hardware metrics address different questions.
Do not treat separation as proof of independence
Different ECUs, suppliers or device models can be inputs to an analysis, but those labels alone do not establish that common causes or coupling are absent. Explain how the design prevents root causes, controls effects or reduces coupling factors, the measure categories listed in Clause 7.4.7.
DFA does not lower an ASIL automatically. Use the applicable decomposition rules, a sufficient-independence argument and formal safety review to decide whether decomposition is justified.
Common questions
- Is DFA the same as ASIL decomposition?
- No. ASIL decomposition is addressed in ISO 26262-9 Clause 5 and DFA in Clause 7; Clause 5.4.3 uses the DFA result to support a sufficient-independence judgement.
- Is placing redundant channels in separate ECUs enough?
- Physical separation alone is not a conclusion. Analyse plausible dependent-failure causes, their effects and the controls, and retain the supporting rationale.
- Can a hardware metric replace DFA?
- No. SPFM, LFM and PMHF have different scopes from DFA. Meeting a hardware metric reference value does not by itself demonstrate sufficient independence for decomposition.
Sources and scope
- ISO 26262-9:2018
The page paraphrases ISO 26262-9:2018 Clauses 5.4.3, 7.4.1, 7.4.2 and 7.4.7; no standard text is reproduced.