Verlässliche Echtzeitsysteme – Können Wir Unseren Autos Noch Vertrauen? Contents Contents Method Park
Total Page:16
File Type:pdf, Size:1020Kb
Contents Verlässliche Echtzeitsysteme – Who is Method Park? Können wir unseren Autos noch vertrauen? Why do we need Safety Standards? Bernhard Sechser Process and Safety demands in Automotive Method Park Software AG, Erlangen 30.04.2012 Hazard Analysis and Risk Assessment Functional and Technical Development Software Process in detail Tool Qualification Summary © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 2 of 69 Contents Method Park - Facts and Figures Who is Method Park? Facts Awards • Founded in 2001 2004 2005 • Locations: 2008 Why do we need Safety Standards? Germany: Erlangen, Munich 2011 USA: Detroit, Miami Process and Safety demands in Automotive 2006, 2007, 2009 2009 Hazard Analysis and Risk Assessment Revenue & employees Business unit revenue Functional and Technical Development 33% Software Process in detail 45% Products Training & Consulting Engineering Tool Qualification 22% Summary © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 3 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 4 of 69 Portfolio Our Customers Product Engineering Automotive Engineering/ Healthcare Defense Areas: •Audi Automation •Carl Zeiss •Airbus Deutschland •Automotive Lighting •7 layers •Siemens •Diehl • Project Coaching •Blaupunkt •ABB •Fresenius •EADS • Software Development & Support •BMW •BDT •Agfa •Raytheon Anschütz Solution for integrated • On Site Support •Bosch •Carl Schenk •Ziehm Imaging •KID •Brose •EBM Papst •NewTec process management • Off Site Projects •Continental •Heidelberger •Innovations Software Further • Fixed Price Projects •Daimler Druckmaschinen •Technology •Bosch und Siemens Hausgeräte •Delphi •Insta •Deutsche Post •ETAS •Kratzer Automation IT/ •GMC Software Technologies •Helbako •Magirus Telecommunications •Kodak •IAV •Mettler Toledo •GFT •Landesbank Kiel •Knorr-Brakes •Mühlbauer Group •Intersoft •Raab Karcher Consulting/Coaching Training •Marquardt •Rohde&Schwarz •Nash Technologies •Giesecke & Devrient •Peiker Acustic •Siemens Industries •NEC •Thales Rail Signaling •Preh •Wago •Micronas Topics: Wide range of seminars in the division •Thales •Siemens • Software Process Improvement system and software development •TRW Government/Public •Teleca • CMMI®, SPICE, Automotive SPICE® •Volkswagen •Bundesagentur für Arbeit •Webasto •Curiavant • AUTOSAR, Functional Safety Accredited by the following organizations: SEI, ISTQB, ISQI, INTACS, IREP •ZF •Kassenärztliche Vereinigung • Requirements Management •Zollner Baden-Württemberg • Project and Quality Management • Software Architecture & Design • Software Testing © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 5 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 6 of 69 Contents Examples Who is Method Park? Ariane 5 (July 4th, 1996) Detonation shortly after Why do we need Safety Standards? takeoff because of an error in the control software Process and Safety demands in Automotive Root cause: Insufficient tests of a reused Hazard Analysis and Risk Assessment “proven in use” software component Functional and Technical Development Software Process in detail Tool Qualification Source: ESA Summary Source: YouTube © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 7 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 8 of 69 Examples Examples Application that can cause harm (a risk): Airbag exploding when infant is sitting in front seat Need to assess the risk Infant getting injured – “not good at all” Find a mitigation strategy, e.g. a safety function: Detecting infant in front seat and disabling airbag a) sensor delivers signal to b) software/hardware controlling an c) actuator (disabler) Question: How to measure Functional Safety is then: and agree on the Question: Do we dare putting An infant in front seat is not exposed measures? software in direct to an unacceptable (unreasonable) risk control of people’s life? © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 9 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 10 of 69 Reasons for Failures 63% Complexity 60% Root cause analysis of software failures in 90 50% healthcare companies 40% 30% 20% 16% 10% 11% 10% Implementation Architecture Requirements Other Design Source: Fraunhofer Institute for Experimental Software Engineering 2007 Source: © Courtesy of Daimler; Presentation given at Automotive Electronics and Electrical Systems Forum 2008, May 6, 2008, Stuttgart, Germany © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 11 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 12 of 69 Extract from German law Contents § 823 Abs. 1 BGB: Who is Method Park? „Anyone who injures intentionally or negligently the life, body, health, liberty, property or any other right of another person, is Why do we need Safety Standards? obliged to compensate for the resulting damages.“ Process & Safety demands in Automotive § 1 Abs. 1 ProdhaftG: „If someone is killed, his body or health injured or an item Hazard Analysis and Risk Assessment damaged by a defect in a product, the manufacturer of the product is obliged to replace the resulting damages.“ Functional and Technical Development Software Process in detail Tool Qualification Summary © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 13 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 14 of 69 Definitions Existing Standards IEC 61508 Safety Functional safety of electrical / electronic / … is the absence of unacceptable (unreasonable) risks that can programmable electronic safety-related systems cause harm achieved through a planned strategy Functional Safety EN 62061 EN 50271 IEC 61511 … is part of the overall safety that depends on a system or ISO 13849 EN 50402 Automation equipment operating correctly in response to its inputs. Manufactoring Gas Measuring … is achieved when every specified safety function is carried out and the level of performance required of each safety function is IEC 61513 EN 50126 DO 178B met IEC 60880 EN 50128 Aviation … is not to provide the perfect car, but a safe car. Nuclear EN 50129 Rail Functional Safety Management IEC 62304 ISO 26262 … is the management (plan, do, act, check) of all activities Medical Automotive necessary to reach functional safety. © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 15 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 16 of 69 Scope of ISO 26262 Structure of ISO 26262 Why not using IEC 61508? Lessons learnt from application of IEC 61508 in automotive industry: Not adapted to real-time and integrated embedded systems Not adapted to automotive development and life cycles No requirements for manufacturer / supplier relationship No ‘consumer-goods’ orientation … Companies had to solve these issues themselves until introduction of Source: ISO/FDIS 26262 - BL18 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 17 of 69 © 2012 Method Park Software AG / Bernhard Sechser / 30.04.2012 / Verlässliche Echtzeitsysteme Slide 18 of 69 ISO 15504 & Automotive SPICE ® Structure of ISO 26262 Primary Life Cycle Processes Supporting Life Cycle Processes AcquisitionAcquisition ProcessProcess GroupGroup (ACQ)(ACQ) SupportSupport ProcessProcess GroupGroup (SUP)(SUP) ACQ.1ACQ.1 AcquisitionAcquisition preparationpreparation AA H H SUP.1 SUP.1 QualityQuality assuranceassurance ACQ.2ACQ.2 SupplierSupplier selectionselection AA SUP.2 SUP.2 VerificationVerification Management Process Improvement Resource & Infrastructure AA ACQ.3 ACQ.3 ContractContract agreementagreement SUP.3SUP.3 ValidationValidation AA H H ACQ.4 ACQ.4 SupplierSupplier monitoringmonitoring AA SUP.4 SUP.4 JointJoint reviewreview ACQ.5ACQ.5 CustomerCustomer acceptanceacceptance SUP.5SUP.5 AuditAudit AA ACQ.11 ACQ.11 TechnicalTechnical requirementsrequirements SUP.6SUP.6 ProductProduct evaluationevaluation AA ACQ.12 ACQ.12 LegalLegal andand administrativeadministrative requirementsrequirements A SUP.7 Documentation Process Category Process A SUP.7 Documentation Process Group Process AA ACQ.13 ACQ.13 ProjectProject requirementsrequirements A H SUP.8 Configuration management Engineering (System) Process A H SUP.8 Configuration management AA ACQ.14 ACQ.14 RequestRequest forfor proposalsproposals AA H H SUP.9 SUP.9 ProblemProblem resolutionresolution managementmanagement AA ACQ.15 ACQ.15 SupplierSupplier qualificationqualification AA H H SUP.10 SUP.10 ChangeChange requestrequest managementmanagement SupplySupply ProcessProcess GroupGroup (SPL)(SPL) Organizational Life Cycle Processes AA SPL.1 SPL.1 SupplierSupplier tenderingtendering AA SPL.2 SPL.2 ProductProduct releaserelease ManagementManagement ProcessProcess GroupGroup (MAN)(MAN) Operation SPL.3SPL.3 ProductProduct acceptanceacceptance supportsupport MAN.1MAN.1 OrganizationalOrganizational alignmentalignment MAN.2MAN.2 OrganizationalOrganizational managementmanagement