Brake-By-Wire & ADAS Domain Controller
An automotive Tier-1 (~2,000 staff, ~800 engineers, 30 on this program) is developing an ASIL D brake-by-wire / electric-power-steering actuator ECU and its ADAS domain-controller interface for a software-defined vehicle. The safety MCU is an Infineon AURIX TC39x — delayed dual-core lockstep TriCore at 300 MHz, on-chip Safety Management Unit, ECC memory and an MPU for freedom-from-interference. The ADAS side pairs a 254-TOPS NVIDIA Orin (AUTOSAR Adaptive on QNX, hardened safety island) with the AURIX as arbiter. The HARA rates unintended steering/brake torque at speed at S3/E4/C3 → ASIL D, with a safe state that must be reached within a ~100 ms Fault-Tolerant Time Interval.
Illustrative scenario — representative figures, not a customer result.
ASIL D verification front-loaded off the HIL bench
reaction time & interference-freedom formally proven
one model, both R155 and 26262 cases
- Functional Safety Manager (safety case, ASIL decomposition, DIA with the OEM)
- Systems / E-E architect (zonal vs domain topology, timing budgets)
- Model-based-design software team (Simulink + Embedded Coder)
- Verification / HIL team (MC/DC, fault injection, dSPACE SCALEXIO)
- Cybersecurity engineer (ISO 21434 TARA, CSMS for UN R155)
- Independent functional-safety assessor (I3) + ASPICE (intacs) assessor
- Siemens Polarion / PTC Codebeamer — FSR/TSR traceability, ASPICE SWE.1-6
- Simulink + Embedded Coder + IEC Cert Kit — Qualified ASIL D C/AUTOSAR generation
- Polyspace Code Prover — Absence of run-time errors, MISRA
- VectorCAST — Unit/integration test, 100% MC/DC
- dSPACE SCALEXIO + Vector CANoe — HIL, fault injection, residual-bus
ASIL D verification — 100% MC/DC plus fault injection to the FTTI plus back-to-back model-vs-code testing — runs roughly 3–5× the effort of ASIL A, and the chronic killer is late integration: with >100M lines of code across dozens of ECUs, interface and timing defects only surface on the SCALEXIO bench. Freedom-from-interference between mixed-ASIL partitions must be argued, not hand-waved, and UN R155 cybersecurity type approval — mandatory for all new vehicle registrations since July 2024 — gates release alongside the ISO 26262 safety case.
The ASIL D test tax
100% MC/DC on the ASIL D units, fault injection to prove reaction within the FTTI, and back-to-back model-vs-code testing — at roughly 3–5× the effort of an ASIL A equivalent.
Freedom-from-interference is asserted, not proven
Mixed-ASIL partitions on the AURIX MPU and the E2E-protected buses need a common-cause / independence argument to justify decomposing the ASIL D goal into B(D)+B(D). Today that argument is prose in the safety case.
Defects hide until integration
Timing and interface faults across the zonal Ethernet + CAN-FD/FlexRay only appear when everything meets on the HIL bench, where root-cause is hardest and rework is most expensive.
Safety and cyber are two separate cases
The ISO 26262 safety case and the ISO 21434 cyber-case for UN R155 are built by different teams with no shared formal basis — duplicating requirements and verification work.
A ~3–5× ASIL D verification campaign on a €4.8M/yr program, freedom-from-interference argued in prose, defects discovered late on the HIL bench — and the safety and cyber cases authored separately.
One coherent flow, applied to this system.
-
01Requirements Structure Safety Goals → FSR → TSR and run an ISO 21434-style TARA.
Dextra ingests the HARA output and structures Safety Goals → functional (FSR) → technical (TSR) safety requirements with traceability IDs for ASPICE SWE.1-6, while the threat library runs a TARA on the CAN-FD/FlexRay interface (spoofed torque request → SFOP impact → CAL) that feeds both the safety case and the UN R155 cyber-case.
Output Structured FSR/TSR + threat scenarios feeding safety case and cyber-case. -
02Behaviour Model the safe-state logic and E2E protection as timed automata.
The safety loop becomes timed automata: sensor/lockstep/ECC/watchdog fault → half-bridge to safe-state-off within the FTTI; each safety PDU checked for AUTOSAR E2E (CRC + alive counter + Data ID). TCTL properties for the FTTI reaction and E2E validity are derived.
Output Timed-automaton contract + TCTL FTTI / E2E properties. -
03Formal verification Prove the FTTI reaction and freedom-from-interference under injected faults.
Model checking proves the safe-state reaction holds within the FTTI under injected fault modes (stuck sensor, RAM bit-flip) and proves freedom-from-interference / common-cause absence for the ASIL decomposition — discharging a share of the fault-injection and back-to-back campaign, with Polyspace-style absence-of-runtime-error proofs supplementing. (Honest note: on-target HIL fault injection remains; proofs pre-discharge and target the assessor-ready pack.)
Output Machine-checked FTTI + freedom-from-interference proofs mapped to ISO 26262 Part 6 work products. -
04Design-space exploration Trade fail-safe vs fail-operational architectures, proving channel independence.
The Pareto trade runs single AURIX vs AURIX + independent monitor vs a 1oo2D redundant pair × 12 V/48 V power × redundant CAN-FD/FlexRay/Ethernet — each checked for fail-operational behaviour and scored on cost/mass/power, and each proving the two decomposed ASIL B(D) channels share no processor, power rail or clock.
Output Pareto of fail-operational architectures with proven independence. -
05Platform selection Fix the ASIL D platform with MPU-enforced partitioning.
The selection lands, for example, an AURIX TC39x running the primary control channel and an independent monitor on the second lockstep pair, MPU-enforced freedom-from-interference between the ASIL D brake partition and QM partitions, and E2E-wrapped actuation on redundant CAN-FD.
Output Fully specified ASIL D platform with partitioning contract. -
06Certification artifacts Emit verified AUTOSAR code and generate safety + cyber cases together.
Verified MISRA-C/AUTOSAR is emitted to a qualified backend (Embedded Coder + IEC Certification Kit, or SCADE), and the GSN-style safety case, the UN R155 cyber-case and the MC/DC evidence are generated as review-ready work products for the I3 functional-safety assessor — both cases drawn from one formal model.
Output Safety case + cyber-case + coverage evidence, from one model.
AG(sensor_fault → AF≤FTTI safe_state_off)
Any detected sensor or lockstep fault forces the brake actuator to its safe state within the Fault-Tolerant Time Interval (~100 ms).
AG(chan_A ∦ chan_B) — freedom-from-interference
The two decomposed ASIL B(D) channels share no processor, power rail or clock — common-cause coupling is provably absent, so the ASIL D → B(D)+B(D) decomposition is valid.
AG(pdu_received → (e2e_valid ∨ AF≤T reject))
Every safety PDU is E2E-checked (CRC, alive counter, Data ID) and an invalid frame is rejected within bound — letting a QM bus safely carry ASIL D data.
An interactive Pareto frontier for this system — every point a valid, formally checked configuration. Hover any point to inspect the full hardware-software specification.
Modeled, conservative and sourced — see the full ROI methodology.
The ASIL D verification tax moves left: FTTI reactions and freedom-from-interference are proven before the SCALEXIO bench instead of chased on it, the ASIL decomposition rests on a machine-checked independence argument, and the safety case and the UN R155 cyber-case are generated from one formal model. Modeled ROI: ~338%, payback under three months.
See how the pipeline works.
From requirements to certified artifacts, in six stages.