All use cases
Automotive · ISO 26262 ASIL D

Brake-By-Wire & ADAS Domain Controller

ISO 26262 ASIL D · ISO/SAE 21434 · UN R155 · ASPICE CL3

An automotive Tier-1 (~2,000 staff, ~800 engineers, 30 on this program) is developing an ASIL D brake-by-wire / electric-power-steering actuator ECU and its ADAS domain-controller interface for a software-defined vehicle. The safety MCU is an Infineon AURIX TC39x — delayed dual-core lockstep TriCore at 300 MHz, on-chip Safety Management Unit, ECC memory and an MPU for freedom-from-interference. The ADAS side pairs a 254-TOPS NVIDIA Orin (AUTOSAR Adaptive on QNX, hardened safety island) with the AURIX as arbiter. The HARA rates unintended steering/brake torque at speed at S3/E4/C3 → ASIL D, with a safe state that must be reached within a ~100 ms Fault-Tolerant Time Interval.

Illustrative scenario — representative figures, not a customer result.

3–5× tax

ASIL D verification front-loaded off the HIL bench

FTTI + FFI

reaction time & interference-freedom formally proven

Safety + cyber

one model, both R155 and 26262 cases

  • Functional Safety Manager (safety case, ASIL decomposition, DIA with the OEM)
  • Systems / E-E architect (zonal vs domain topology, timing budgets)
  • Model-based-design software team (Simulink + Embedded Coder)
  • Verification / HIL team (MC/DC, fault injection, dSPACE SCALEXIO)
  • Cybersecurity engineer (ISO 21434 TARA, CSMS for UN R155)
  • Independent functional-safety assessor (I3) + ASPICE (intacs) assessor
  • Siemens Polarion / PTC Codebeamer — FSR/TSR traceability, ASPICE SWE.1-6
  • Simulink + Embedded Coder + IEC Cert Kit — Qualified ASIL D C/AUTOSAR generation
  • Polyspace Code Prover — Absence of run-time errors, MISRA
  • VectorCAST — Unit/integration test, 100% MC/DC
  • dSPACE SCALEXIO + Vector CANoe — HIL, fault injection, residual-bus

ASIL D verification — 100% MC/DC plus fault injection to the FTTI plus back-to-back model-vs-code testing — runs roughly 3–5× the effort of ASIL A, and the chronic killer is late integration: with >100M lines of code across dozens of ECUs, interface and timing defects only surface on the SCALEXIO bench. Freedom-from-interference between mixed-ASIL partitions must be argued, not hand-waved, and UN R155 cybersecurity type approval — mandatory for all new vehicle registrations since July 2024 — gates release alongside the ISO 26262 safety case.

The ASIL D test tax

100% MC/DC on the ASIL D units, fault injection to prove reaction within the FTTI, and back-to-back model-vs-code testing — at roughly 3–5× the effort of an ASIL A equivalent.

Freedom-from-interference is asserted, not proven

Mixed-ASIL partitions on the AURIX MPU and the E2E-protected buses need a common-cause / independence argument to justify decomposing the ASIL D goal into B(D)+B(D). Today that argument is prose in the safety case.

Defects hide until integration

Timing and interface faults across the zonal Ethernet + CAN-FD/FlexRay only appear when everything meets on the HIL bench, where root-cause is hardest and rework is most expensive.

Safety and cyber are two separate cases

The ISO 26262 safety case and the ISO 21434 cyber-case for UN R155 are built by different teams with no shared formal basis — duplicating requirements and verification work.

Without Dextra

A ~3–5× ASIL D verification campaign on a €4.8M/yr program, freedom-from-interference argued in prose, defects discovered late on the HIL bench — and the safety and cyber cases authored separately.

One coherent flow, applied to this system.

  1. 01
    Requirements Structure Safety Goals → FSR → TSR and run an ISO 21434-style TARA.

    Dextra ingests the HARA output and structures Safety Goals → functional (FSR) → technical (TSR) safety requirements with traceability IDs for ASPICE SWE.1-6, while the threat library runs a TARA on the CAN-FD/FlexRay interface (spoofed torque request → SFOP impact → CAL) that feeds both the safety case and the UN R155 cyber-case.

    Output Structured FSR/TSR + threat scenarios feeding safety case and cyber-case.
  2. 02
    Behaviour Model the safe-state logic and E2E protection as timed automata.

    The safety loop becomes timed automata: sensor/lockstep/ECC/watchdog fault → half-bridge to safe-state-off within the FTTI; each safety PDU checked for AUTOSAR E2E (CRC + alive counter + Data ID). TCTL properties for the FTTI reaction and E2E validity are derived.

    Output Timed-automaton contract + TCTL FTTI / E2E properties.
  3. 03
    Formal verification Prove the FTTI reaction and freedom-from-interference under injected faults.

    Model checking proves the safe-state reaction holds within the FTTI under injected fault modes (stuck sensor, RAM bit-flip) and proves freedom-from-interference / common-cause absence for the ASIL decomposition — discharging a share of the fault-injection and back-to-back campaign, with Polyspace-style absence-of-runtime-error proofs supplementing. (Honest note: on-target HIL fault injection remains; proofs pre-discharge and target the assessor-ready pack.)

    Output Machine-checked FTTI + freedom-from-interference proofs mapped to ISO 26262 Part 6 work products.
  4. 04
    Design-space exploration Trade fail-safe vs fail-operational architectures, proving channel independence.

    The Pareto trade runs single AURIX vs AURIX + independent monitor vs a 1oo2D redundant pair × 12 V/48 V power × redundant CAN-FD/FlexRay/Ethernet — each checked for fail-operational behaviour and scored on cost/mass/power, and each proving the two decomposed ASIL B(D) channels share no processor, power rail or clock.

    Output Pareto of fail-operational architectures with proven independence.
  5. 05
    Platform selection Fix the ASIL D platform with MPU-enforced partitioning.

    The selection lands, for example, an AURIX TC39x running the primary control channel and an independent monitor on the second lockstep pair, MPU-enforced freedom-from-interference between the ASIL D brake partition and QM partitions, and E2E-wrapped actuation on redundant CAN-FD.

    Output Fully specified ASIL D platform with partitioning contract.
  6. 06
    Certification artifacts Emit verified AUTOSAR code and generate safety + cyber cases together.

    Verified MISRA-C/AUTOSAR is emitted to a qualified backend (Embedded Coder + IEC Certification Kit, or SCADE), and the GSN-style safety case, the UN R155 cyber-case and the MC/DC evidence are generated as review-ready work products for the I3 functional-safety assessor — both cases drawn from one formal model.

    Output Safety case + cyber-case + coverage evidence, from one model.
AG(sensor_fault → AF≤FTTI safe_state_off)

Any detected sensor or lockstep fault forces the brake actuator to its safe state within the Fault-Tolerant Time Interval (~100 ms).

AG(chan_A ∦ chan_B) — freedom-from-interference

The two decomposed ASIL B(D) channels share no processor, power rail or clock — common-cause coupling is provably absent, so the ASIL D → B(D)+B(D) decomposition is valid.

AG(pdu_received → (e2e_valid ∨ AF≤T reject))

Every safety PDU is E2E-checked (CRC, alive counter, Data ID) and an invalid frame is rejected within bound — letting a QM bus safely carry ASIL D data.

An interactive Pareto frontier for this system — every point a valid, formally checked configuration. Hover any point to inspect the full hardware-software specification.

BOM Cost (€) Security Level
Pareto-optimal Dominated Hover any point to inspect →
Cert-relevant spend
€4.8M/yr
Gross saving
€1.09M (23%)
License
Enterprise ~€250k/yr
Payback
~2.7 months
Annual ROI
338%
NPV (10%, 5yr)
€3.20M

Modeled, conservative and sourced — see the full ROI methodology.

The ASIL D verification tax moves left: FTTI reactions and freedom-from-interference are proven before the SCALEXIO bench instead of chased on it, the ASIL decomposition rests on a machine-checked independence argument, and the safety case and the UN R155 cyber-case are generated from one formal model. Modeled ROI: ~338%, payback under three months.

See how the pipeline works.

From requirements to certified artifacts, in six stages.