Safe and sound

Nick Flaherty delves deep into the levels of functional safety intended to manage the risks associated with the electrical and electronic systems of EVs

Enhancing EV safety is not all about physical safety aspects. Functional safety is a crucial element of EV design intended to prevent and mitigate hazards caused by system faults and malfunctions, particularly with the increasing use of leading-edge semiconductors and complex software.

One of the core standards for functional safety is ISO 26262, which defines best practices for implementing functional safety and guiding product development on system, hardware and software levels.

It provides guidelines and recommendations throughout the product development process, from conceptual development through end of life. It details how to realise an acceptable level of risk by defining the risk reduction activities for development through a V-curve, with the left-hand side of the V-curve representing the systems engineering and the right-hand side representing testing and validation of the specification.

This process provides an automotive-specific risk-based approach for determining risk classes – the Automotive Safety Integrity Levels (ASILs). These ASILs specify the safety requirements necessary for an item to achieve an acceptable risk level. Components can typically be certified only to the ASIL-B level, with the highest level, ASIL-D, reserved for systems that combine hardware and software. The increased use of AI, lifetime management and cybersecurity brings new challenges for both identifying the risks and certifying that those risks are addressed and mitigated.

Ultimately, ISO 26262 allows a trade-off between redundancy and reliability to ensure that functional safety requirements are achieved.

Hazard analysis & risk assessment

The process begins with hazard analysis and risk assessment. This involves identifying potential hazardous malfunctions, assessing their severity across a variety of scenarios, determining any controllability opportunities and determining the level of risk mitigation required for each malfunction. Upon completion of this activity, engineers can establish safety goals and define the necessary safety requirements to achieve them.

The thermal and functional risks of the high-voltage system in an EV are generally well understood. Without application of ISO 26262 in the design process, an architecture would still include redundancy and monitoring to ensure that critical functions such as the propulsion system can be maintained even in the event of a failure of the electronics.

However, safety being taken into consideration is insufficient compared to the systematic, disciplined approach provided by the ISO 26262 standard, which enables quantifiable risk reduction practices.  Is simple redundancy enough? The BMS plays a vital role in monitoring and controlling the state of a battery pack, and redundancy measures are also implemented within the BMS to enable accurate monitoring, fault detection and even cell balancing. However, common redundant elements may not provide the level of risk reduction necessary to achieve an acceptable risk tolerance level.

To protect the electrical components and ensure safe operation, EVs incorporate overcurrent protection mechanisms and current-limiting devices. These systems continuously monitor the current flow and intervene to prevent excessive current, which can lead to component damage or safety hazards.

Efficient thermal management and cooling systems are critical for maintaining safe operating temperatures in EVs. Overheating can lead to performance degradation, accelerated wear and potential safety risks. Therefore, active cooling mechanisms such as liquid or air cooling are employed to regulate temperatures and prevent thermal runaway.

Failure modes

Failure modes and effects analysis (FMEA) or system theoretic process analysis are systematic methods used to identify potential failure modes, their causes and their effects. By analysing the failure modes, design modifications and safety features can mitigate the identified risks.

Cybersecurity & functional safety

With the increasing connectivity adopted in EVs, cybersecurity becomes a significant element of functional safety. EVs must employ cybersecurity measures to prevent unauthorised access, data manipulation or remote control of critical systems because a system that is not secure is not safe. The ISO 21434 standard assists with implementing secure communication protocols between vehicle components and external systems where encryption and authentication mechanisms play a significant role in enhancing the integrity and security of all communications.

Comprehensive diagnostic mechanisms monitor critical components and systems continuously. Fault tolerance is achieved through redundancy and backup systems that allow the vehicle to operate safely, even in the presence of failures or faults.

High-voltage components in EVs require effective insulation and isolation techniques to minimise the risk of electrical shock or short circuits. Insulation materials, such as high dielectric strength polymers, are used to separate conductive parts and prevent unintended electrical contact.

EVs employ various measures to contain electrical hazards, such as high-voltage interlock loops (HVILs) and reinforced enclosures. HVILs ensure that high-voltage systems are deactivated when the vehicle is not in operation or during maintenance, thereby reducing the risk of electrical accidents.

Combining ISO 26262 functional safety standards with ISO/SAE 21434 cybersecurity and advanced standards such as ISO/PASS 8800 supports development of dependable, software-defined electric and autonomous vehicle architectures.

Testing & validation of safety systems

Virtual simulations and hardware-in-the-loop testing allow engineers to evaluate the performance and safety of EV systems in a controlled environment. These testing methods enable comprehensive analysis and validation of safety systems without relying solely on physical prototypes. Digital twins can assist with this process, bringing together virtual models that are part of the vehicle. These models are also used for monitoring the performance of the systems throughout the vehicle’s lifecycle, and even predicting potential faults in the digital twin before they occur in the real world.

Real-world testing is essential to validate the functional safety of EVs in diverse operational conditions. Through rigorous testing on test tracks, public roads and in various environmental scenarios, engineers can identify potential risks, refine safety measures and feed this data back into the digital twin.

“Standards are vital because as we add more technology, we also introduce more risk,” said Jyotika Athavale, architecture director at Synopsys, which has a wide range of components and tools for functional safety.

These extend from design tools to automate failure modes, effects and diagnostic analysis (FMEDA) and FMEA to calculate single-point fault metrics and latent fault metrics. Other tools automatically insert safety mechanisms, such as dual-core lockstep (DCLS) or triple modular redundancy (TMR), during the synthesis of a design into the register-transfer level and the layout routing of a chip, while verification tools test how safety-critical chips respond to random hardware faults or errors.

“My committee at the Institute of Electrical and Electronics Engineers (IEEE) administers IEEE P2851, which sets guidelines for designing, implementing and evaluating safety-critical systems,” said Athavale. “The standard outlines essential methods, description languages, data models and databases that can be used across the industry.

“By following these technology-agnostic standards, manufacturers can build safer vehicles. They can also reduce costs associated with redesigns and recalls due to safety issues. These standards – along with others that govern vehicle safety – enable the exchange and interoperability of data across all steps of the vehicle’s lifecycle. They also evolve as new technologies emerge, such as AI.”

Designs for the ARC processor are packaged with ready-to-use safety manuals, FMEDA reports and diagnostic metrics to target up to ASIL-D compliance levels. The ASIL-compliant IP includes pre-verified interface, processor and security IP, such as automotive physically unclonable functions and memory controllers, which handle random hardware faults and systematic faults.

On-chip infrastructure such as the ARC processors are used to coordinate power-on self-tests and periodic mission-mode testing.

Often, one approach to functional safety is to add redundancy; however, that is not always possible.

Techniques such as TMR and dual modular redundancy (DMR) provide an extra layer of protection against errors by replicating critical components of a system. TMR involves triplicating key system elements and using majority voting to determine the correct output, thereby mitigating the impact of faults. DMR is a more resource-efficient approach that relies on duplicating components and comparing their outputs to detect inconsistencies.

DMR is particularly advantageous in applications where power, cost and space constraints make TMR less practical, but where fault detection and mitigation still remain critical. These fault-tolerant architectures are further augmented by rigorous software validation, creating a comprehensive safety framework for systems that cannot afford failure.

An example of DMR is the DCLS mechanism used in safety-critical applications, such as the aviation and automotive sectors, where high-reliability computing and fault-tolerant operation are required. DCLS can also be used as protection against side-channel attacks in security contexts like a root of trust macro (RoT), where it can help detect and prevent error injection when the attacker gains physical access to the chip. The latter case is why DCLS is now being implemented for the Caliptra RoT project in the CHIPS Alliance.

As part of that project, Antmicro in Poland has developed DCLS functionality in the VeeR EL2, which is a 32 bit core variant from the open source VeeR family of RISC-V processor cores hosted by the CHIPS Alliance.

This DCLS module detects errors in a second, shadow core. If at any moment the original core produces different outputs from the shadow core, a corruption is detected and reported. Because the shadow core module must replicate the behaviour of the main core without any differences, it contains the same input and output ports; however, the input data for the main core is delayed before being routed to the shadow core, and the output data from the shadow core is compared with the delayed output data from the main core.

This can be used to detect errors such as radiation or cyberattacks. The shadow core is delayed by a constant, configurable number of clock cycles with respect to the main core. If an attacker wants to somehow alter the behaviour of the main core, they would also need to know the delay of the copy (the shadow core) and alter it in the exact same way, after this specific delay. This complicates the attack greatly and thus increases the level of security of the system.

Software

High-integrity software languages can also be used to improve the functional safety of the software in an EV. The Ada and SPARK programming languages can now be used in automotive design through a partnership with NVIDIA with an off-the-shelf reference process for ISO 26262.

NVIDIA used the languages for its Drive OS automotive operating system and associated software stack. This system includes software components that comply with the highest levels of integrity of the automotive certification standard ISO 26262. To achieve that effort, NVIDIA selected these languages to develop some of the most critical components of its software stack. This required establishing a development process that takes advantage of formal methods and other safety characteristics of Ada and SPARK, thus fully leveraging their capabilities.

“As the added value of the automotive industry turns more and more from mechanical to software features, achieving software safety at the highest levels becomes one of the most critical challenges of modern car development,” said Quentin Ochem, chief product officer at AdaCore.

“Traditionally, developers have had to wear many hats – beyond writing code, they often find themselves taking on the responsibilities of QA engineers, verification engineers and even requirements engineers,” he added. “Safety-critical domains like automotive, governed by standards such as ISO 26262, demand rigorous traceability, evidence of correctness and formal assurance.”

As a result, AdaCore and NVIDIA have published the reference process freely as an open-source and evolving document, allowing the industry at large to adopt Ada and SPARK.

The document defines a SPARK-based ISO-26262-compliant process for developing a subset of the safety-critical vehicle software units to ASIL-D and to lower ASILs.

It covers the ISO 26262 requirements and objectives relevant to language subsets, software unit design, software unit implementation and software unit verification. Additionally, the process covers the ISO 26262 requirements and objectives related to safety requirements when they are expressed in software interface specifications.

However, the process applies exclusively to software units that are developed entirely in the Ada programming language, but is oriented towards software units for which some or all of the Ada code complies with the SPARK subset. While some elements of this process, such as the required Ada compiler warning settings, may be applicable to safety-critical Ada software development in general, a software unit that mixes Ada with other languages (such as C, C++ or assembly language) cannot be developed using this process.

The process supports formal verification and non-formal verification side by side. A single software unit developed according to this process can be formally verified in its entirety, non-formally verified in its entirety, or partially formally verified and partially non-formally verified.

“In short, this move helps demystify safety certification for developers, and paves the way for more robust and efficient software-defined vehicle architectures,” said Ochem.

“It’s also rare to see a major technology provider open up their internal safety certification process to this degree. The fact that NVIDIA’s ISO 26262 documentation is usable off-the-shelf is a big deal – it provides a concrete, practical starting point for other automotive software teams. It lowers the barrier to entry for developers and companies aiming to build safe, certified vehicle software, without reinventing the wheel.”

The ISO 26262 reference process is available on GitHub and can be used or customised freely by anyone interested in adopting these languages.

Lotus has rolled out an over-the-air update that includes a series of safety enhancements. Both the Eletre and the Emeya EVs have received improved insulation-fault monitoring, enabling earlier detection of potential issues, earlier warnings and automatic system protection.

Monitoring

Predictive maintenance uses advanced analytics and machine learning algorithms to forecast potential failures before they occur. This approach can be applied to any part of a vehicle and is increasingly used at the silicon level to anticipate chip degradation.

Predictive maintenance techniques can monitor the health of an engine’s ECU or the BMS in EVs. By predicting when critical components might fail, these techniques allow for timely maintenance.

To achieve the best results, the vehicle operating system must analyse vast amounts of data using advanced technologies that can identify patterns and predict potential failures with high precision. This involves leveraging edge computing to process data locally on the vehicle, and using cloud computing to aggregate and analyse data at scale.

Advanced machine learning models are trained on both historical and real-time data to recognise early signs of component degradation. For example, a machine learning algorithm might detect a subtle rise in operating temperature that precedes a chip’s failure, allowing maintenance to be scheduled before any damage occurs.

However, to fully realise the benefits of predictive maintenance, a comprehensive framework for managing and utilising this vast amount of data effectively is essential. This is where silicon lifecycle management (SLM) comes into play.

SLM offers a comprehensive approach to managing the data and processes associated with the maintenance and service of vehicle components throughout their lifecycle. By integrating SLM with predictive maintenance, cybersecurity and industry standards, manufacturers can ensure that maintenance activities are timely and aligned with the overall vehicle service strategy.

Integrated, standards-based SLM tools, IP and methodologies provide observability, analytics and automation at the silicon level. For example, a process, voltage and temperature monitor, certified as ASIL-B ready, meets the AEC-Q100 Grade 2 standard for use in chips to provide vital data to be fed back to the digital twin.

Gathering data at every phase of the product lifecycle provides continuous analysis and actionable insights. Not only does this improve design efficiency and quality, but it also helps predict in-field chip degradation or failure.

These automotive-grade IP solutions and the continuous insights from SLM are essential for ensuring the long-term functional safety of modern vehicles.

Electric aircraft

Commercial electric propulsion with battery or hydrogen-fuel-cell powertrains introduces new high-voltage and thermal risks. Therefore, aviation authorities such as the FAA and EASA issue special conditions on a project-by-project basis to bridge gaps where traditional airworthiness codes do not fully cover high-amperage electrical architectures.

These work alongside the functional safety and airworthiness frameworks for electric aircraft that are governed by adapting established aerospace system-safety standards alongside specialised regulatory conditions for high-voltage powertrains and batteries.

The core system and safety assessment standards include SAE ARP4754A / ED-79A, which provides overall guidelines for developing civil aircraft and complex integrated systems. It provides the foundational architecture and requirement traceability from aircraft down to system levels.

SAE ARP4761 / ARP4761A outlines the safety assessment process, which includes functional hazard assessments, fault tree analysis and common mode analysis used to evaluate system failure conditions and assign safety risk tiers.

The hardware–software design is covered by RTCA DO-178C / ED-12C as the baseline standard for airborne software considerations. This ensures software integrity via Design Assurance Levels (A through E, similar to the ASIL-A to -D rating) based on hazard severity.

RTCA DO-254 / ED-80 governs the design assurance and lifecycle safety of complex custom airborne electronic hardware (such as motor controllers and the BMS), while RTCA DO-311 / DO-311A specifically targets minimum operational performance standards for lithium-ion battery systems and packs, dealing with thermal runaway containment and charge control.

Conclusion

The increasing use of AI and complex software in connected e-mobility systems is putting significant pressure on the development of fault tolerant, safety-critical designs. The traditional ISO 26262 process for automotive development and the ARP and DO-1789C standards in aviation are flexible enough to adapt to the new requirements, focusing

on hazard assessments and the mitigation of risks. New semiconductor designs are including IP that provides redundancy and monitoring without adding to the complexity, boosting the reliability and security of designs, which is a key requirement.

The monitoring of e-mobility platforms throughout their lifecycle through use of digital twins is also increasing the safety and reliability of the platforms. Feeding that data into the digital twin throughout the lifetime of the platform allows machine learning algorithms to identify patterns and highlight potential failures or problems before they occur, providing a crucial boost to the functional safety of the vehicle or aircraft.

 Click here to read the latest issue of E-Mobility Engineering.