Early safety evaluation of design decisions in E/E architecture according to ISO 26262

ISO 26262 addresses development of safe in-vehicle functions by specifying methods potentially used in the design and development lifecycle. It does not indicate what is sufficient and leaves room for interpretation. However, the architects of electric/electronic systems need design boundaries to make decisions during architecture evolution without adding a risk of late architectural changes. Designing and changing a system benefits from correct selection of safety mechanisms at early design stages. This paper presents an iterative architecture design and refinement process that is centered around ISO 26262 requirements. We propose a domain-specific modeling scheme and component repositories to build up a bottom-up analysis framework that allows early quantitative safety evaluation. To guarantee that the target ASIL level can be reached, we complement our design-time component-level analysis with conservative top-down analysis. Given that analysis starts at early design stages, evolution of the architecture is supported by different levels of detail used in the analysis framework.