IEEE Consumer Electronics Magazine - April 2017 - 70

In-Vehicle
Networks

ECU

Harsh Operating
Environments
α Particles + Neutrons

Radiations

ECU Faults

Safety
Mitigation Standards
Safety
IEC 61508
Hazards
Permanent Transient Intermittent
ISO 26262
Attacker
Security Attacks
ECU

Goals

Reliability
Availability
Dependability
Safety

FIGURE 1. The risk assessment and design of dependable cybercars.

hardware architectural metrics to assess safety and dependability of a cybercar design as well as various research challenges and future research directions for realizing safe and
dependable cybercars.

OVERVIEW OF SAFETY AND RELIABILITY
Modern automobiles consist of more than 100 ECUs to contrive various distributed control applications. Cybercars will
further increase the proliferation of ECUs, as 90% of modernization in automobiles is due to electronic systems (perceived
by Daimler Chrysler [1]). These innovative applications include x-by-wire systems, such as steer-by-wire, throttle-bywire, brake-by-wire, and various driving assistance systems.
Although computerized control of automotive systems offers
various performance, comfort, and safety benefits, this computerized control also introduces vulnerabilities associated
with electronic designs, such as process variation, electrostatic
discharge, electromagnetic compatibility, and operational lifetime. Considering that the total number of motor vehicle fatalities in the United States from 1899 to 2013 was 3,613,732 [2],
there has been an increasing emphasis on dependability and
safety integration in automobiles.
To assist the design and production of safe automotive systems, the ISO has developed a functional safety standard, ISO
26262 [3]. Although currently there are no legal certification
requirements for adherence of automotive electrical and/or electronic (E/E) systems with ISO 26262, automotive original equipment manufactures (OEMs) are obligated indirectly to produce
safe products that are in compliance with ISO 26262 under
product liability legislation. The product liability law holds
accountable the manufacturers, suppliers, distributors, and retailers for the damages caused by their products [4]. Legally, a
product is considered to be safe if it conforms to the cuttingedge science and technology at the time of the product release.
ISO 26262 is the contemporary state of the art in automotive science and technology and will continue to be regarded as such
until this standard is replaced by a more leading-edge standard.
Incorporating safety and reliability in automotive designs
is not only a legal obligation but also a moral commitment
for automotive OEMs and suppliers, as noted by Werner von
Siemens [5] (founder of Siemens Corporation): "The prevention of accidents must not only be considered as a regulation
by law, but as a matter of human commitment and economic
reason." As electronic systems permeate into safety-critical
70 IEEE Consumer Electronics Magazine

APRIL 2017

functions, reliability, safety, and hazard analysis of failure
modes become imperative. A failure caused by a design error
in safety-critical systems can lead to serious accidents with
ensuing damaging litigation costs, recall costs, and reputation
loss. Significance of dependability assimilation in automotive
electronics (semiconductor components) can be manifested
with a simple example. Volkswagen Group produces more
than 8 million vehicles per year with more than 40 billion
integrated semiconductors. A semiconductor device failure
rate of 0.1 parts per million would result in 4,000 failed vehicles per year due to semiconductor issues [6]. Although
dependability integration in automobiles is indispensable, the
dependability integration presents various challenges.
Figure 1 portrays an overview of risk assessment and
design of dependable cybercars. Harsh operating environments
coupled with external noise and radiation render automotive
electronic systems vulnerable to permanent, transient, and
intermittent faults. While permanent faults can undermine or
halt a system's correct functionality, soft errors induced by
transient faults can remarkably decrease a system's availability.
Addressing soft errors due to neutron strikes portends a substantial problem because sufficient shielding is exorbitantly
costly. Intermittent faults oscillate between quiescent (i.e.,
component functions normally) and active (component malfunctions) states. Integration of safety and dependability in
cybercars requires thorough understanding of different types of
failures, failure modes, and safety standards. The goal of this
article is to provide a concise description of the safety assessment and design of dependable cybercars while at the same
time considering the contemporary state of the art and future
perspectives. The main contributions of this article are as follows:
▼▼ elaboration of automotive safety standards for cybercar
design focusing on ISO 26262
▼▼ elucidation of different types of failures in automotive
electronics, including hardware failures, software failures,
and soft failures
▼▼ characterization of failure modes and failure assessment in
cybercars
▼▼ highlighting various research challenges and future research
directions for designing safe and dependable cybercars.

SAFETY AND SAFETY STANDARDS
Safety is one of the cardinal issues in the design of cybercars.
We define safety with reference to two existing safety

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - April 2017