Verlässliche Echtzeitsysteme – Können Wir Unseren Autos Noch Vertrauen? Contents Contents Method Park
Total Page:16
File Type:pdf, Size:1020Kb
Contents Verlässliche Echtzeitsysteme – ° Who is Method Park? Können wir unseren Autos noch vertrauen? ° Why do we need Safety Standards? Bernhard Sechser ° Process and Safety demands in Automotive Method Park Consulting GmbH, Erlangen 23.06.2015 ° Hazard Analysis and Risk Assessment ° Functional and Technical Development ° Software Process in detail ° Tool Qualification ° Summary © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 2 of 75 Contents Method Park - Facts and Figures ° Who is Method Park? Facts Awards • Founded in 2001 2004 2005 • Locations: 2008 ° Why do we need Safety Standards? Germany: Erlangen, Munich, 2011 Stuttgart USA: Detroit, Miami ° Process and Safety demands in Automotive 2006, 2007, 2009 2009 ° Hazard Analysis and Risk Assessment Revenue & employees Business unit revenue Revenue ° Functional and Technical Development Employees 200 EM / 10 Mio. EUR 24% Method Park Software AG 49% ° Software Process in detail Method Park 100 EM / 5 Mio. EUR Consulting GmbH Method Par Engineering GmbH ° Tool Qualification 26% - 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 ° Summary © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 3 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 4 of 75 Portfolio Our Customers Product Engineering Automotive Engineering/ Healthcare Defense Areas: •Audi Automation •Carl Zeiss •Airbus Deutschland •Automotive Lighting •7 layers •Siemens •Diehl • Project Coaching •Blaupunkt •ABB •Fresenius •EADS • Software Development & Support •BMW •BDT •Agfa •Elbit Solution for integrated • On Site Support •Bosch •Carl Schenk •Ziehm Imaging •Orbital •Brose •EBM Papst •NewTec •Raytheon Anschütz process management • Off Site Projects •Continental •Heidelberger •Innovations Software •KID • Fixed Price Projects •Daimler Druckmaschinen •Technology •Delphi •Insta Further •ETAS •Kratzer Automation IT/ •Bosch und Siemens Hausgeräte Consulting/Coaching Training •HE System Elektronik •Magirus Telecommunications •Deutsche Post •Helbako •Mettler Toledo •GFT •GMC Software Technologies •Hella •Mühlbauer Group •Intersoft •Kodak Topics: Wide range of seminars in the division •IAV •Rohde&Schwarz •Nash Technologies •Landesbank Kiel ® ® • CMMI , SPICE, Automotive SPICE systems and software engineering •Johnson Controls •Siemens Industries •NEC •Raab Karcher • Project Management & Agile Development •Knorr-Brakes •Wago •Micronas •Giesecke & Devrient • Process Improvement & Quality Management Accredited by the following organizations: •Kostal •Siemens •Thales Rail Signaling • Functional Safety (ISO 26262) SEI, ISTQB, iSQI, iNTACS, IREB, iSAQB, ECQA •Marquardt Government/Public •Teleca • Variant & Complexity Management •Peiker Acustic •Bundesagentur für Arbeit • Product Line Management (PLM) •Preh •Curiavant • Application Lifecycle Management (ALM) •Renesas •Kassenärztliche Vereinigung • Requirements Management •Thales Baden-Württemberg • System & Software Architecture & Design •TRW •Volkswagen • AUTOSAR •Webasto • System & Software Testing •Witte Automotive •ZF •Zollner © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 5 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 6 of 75 Contents Example – Ariane 5 (July 4th, 1996) ° Who is Method Park? Detonation shortly after takeoff because of an error in the control software ° Why do we need Safety Standards? Root cause: Insufficient tests of a reused ° Process and Safety demands in Automotive “proven in use” software component ° Hazard Analysis and Risk Assessment ° Functional and Technical Development ° Software Process in detail ° Tool Qualification Source: ESA ° Summary Source: YouTube © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 7 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 8 of 75 Example – Therac-25 Examples Irradiation of patients with a Application that can cause harm (a risk): lethal dose ° Airbag exploding when infant is sitting in front seat Root cause: Insufficient safety functions Need to assess the risk ° Infant getting injured – “not good at all” Find a mitigation strategy, e.g. a safety function: ° Detecting infant in front seat and disabling airbag a) sensor delivers signal to b) software/hardware controlling an c) actuator (disabler) Question: How to measure Functional Safety is then: and agree on the ° An infant in front seat is not exposed measures? to an unacceptable (unreasonable) risk © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 9 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 10 of 75 Examples Reasons for Failures 63% 60% Root cause analysis of software failures in 90 50% healthcare companies 40% 30% 20% 16% 10% 11% 10% Question: Do we dare putting software in direct Implementation Architecture Requirements Other control of people’s life? Design Source: Fraunhofer Institute for Experimental Software Engineering 2007 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 11 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 12 of 75 Complexity Extract from German law § 823 Abs. 1 BGB: „Anyone who injures intentionally or negligently the life, body, health, liberty, property or any other right of another person, is obliged to compensate for the resulting damages.“ § 1 Abs. 1 ProdhaftG: „If someone is killed, his body or health injured or an item damaged by a defect in a product, the manufacturer of the product is obliged to replace the resulting damages.“ Source: © Courtesy of Daimler; Presentation given at Automotive Electronics and Electrical Systems Forum 2008, May 6, 2008, Stuttgart, Germany © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 13 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 14 of 75 Contents Definitions ° Who is Method Park? Safety … is the absence of unacceptable (unreasonable) risks that can ° Why do we need Safety Standards? cause harm achieved through a planned strategy ° Process & Safety demands in Automotive Functional Safety … is part of the overall safety that depends on a system or ° Hazard Analysis and Risk Assessment equipment operating correctly in response to its inputs. … is achieved when every specified safety function is carried out and the level of performance required of each safety function is ° Functional and Technical Development met … is not to provide the perfect car, but a safe car. ° Software Process in detail Functional Safety Management ° Tool Qualification … is the management (plan, do, act, check) of all activities necessary to reach functional safety. ° Summary © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 15 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 16 of 75 Existing Standards Scope of ISO 26262 IEC 61508 Why not using IEC 61508? Functional safety of electrical / electronic / programmable electronic safety-related systems Lessons learnt from application of IEC 61508 in automotive industry: ° Not adapted to real-time and integrated embedded systems EN 62061 EN 50271 ° Not adapted to automotive development and life cycles IEC 61511 ISO 13849 EN 50402 ° No requirements for manufacturer / supplier relationship Automation Manufactoring Gas Measuring ° No ‘consumer-goods’ orientation ° … IEC 61513 EN 50126 DO 178B Companies had to solve these issues themselves until introduction of IEC 60880 EN 50128 Aviation Nuclear EN 50129 Rail IEC 62304 ISO 26262 Medical Automotive © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 17 of 75 © 2015 Method Park Consulting GmbH / Bernhard Sechser / 23.06.2015 / Verlässliche Echtzeitsysteme Slide 18 of 75 Structure of ISO 26262 ISO 15504 & Automotive SPICE ® Primary Life Cycle Processes Supporting Life Cycle Processes Acquisition Process Group (ACQ) Support Process Group (SUP) ACQ.1 Acquisition preparation A H SUP.1 Quality assurance ACQ.2 Supplier selection A SUP.2 Verification A ACQ.3 Contract agreement SUP.3 Validation A H ACQ.4 Supplier monitoring A SUP.4 Joint review ACQ.5 Customer acceptance SUP.5 Audit A ACQ.11 Technical requirements SUP.6 Product evaluation A ACQ.12 Legal and administrative requirements A SUP.7 Documentation Process Category Process Process Group Process A ACQ.13 Project requirements A H SUP.8 Configuration management Process A ACQ.14 Request for proposals A H SUP.9 Problem resolution management A ACQ.15 Supplier qualification A H SUP.10 Change request management Supply Process Group (SPL) Organizational Life Cycle Processes A SPL.1 Supplier tendering A SPL.2 Product release Management Process Group (MAN) SPL.3 Product acceptance support MAN.1 Organizational alignment MAN.2 Organizational management Engineering Process Group (ENG) A H MAN.3 Project management A ENG.1 Requirements elicitation MAN.4 Quality management A H ENG.2 System requirements analysis A MAN.5 Risk management A H ENG.3 System architectural design