ASIL decomposition is only valid when the two channels are sufficiently independent. DFA is the systematic analysis that verifies this independence claim. If DFA finds a common cause failure (CCF) that can affect both channels simultaneously, the decomposition is invalid.
| Type | Definition | Example | ISO 26262 Term |
|---|---|---|---|
| Common Cause Failure (CCF) | Single root cause affects multiple elements simultaneously | Power supply failure kills both redundant CPUs | Cause: single event; Effect: multiple elements |
| Cascading Failure | Failure of one element causes failure of another | Overheating CPU damages adjacent component | Cause: local failure; Effect: propagates |
| Common Mode Failure | Multiple elements fail in the same way for different independent reasons | Both ADC channels drift high due to same design flaw | Cause: shared design; Effect: correlated |
# DFA Worksheet: FCAB ASIL-D Decomposition
# Decomposition: Channel A (ASIL-C(D)) + Channel B (ASIL-D(C))
## 1. Identify Decomposed Elements
- Channel A: FCAB Domain Controller Main CPU (NXP S32G)
- Channel B: Independent Safety MCU (Aurix TC3xx watchdog function)
## 2. Identify Potential Common Cause Failure Initiators
| ID | CCF Initiator | Affects A? | Affects B? | CCF Risk? | Mitigation |
|-------|---------------------------------|-----------|-----------|-----------|-------------------------|
| CCF-01| 12V supply undervoltage | YES | YES | HIGH | Separate voltage regs (LDO per channel); each monitors own supply |
| CCF-02| Ground potential shift | YES | YES | MEDIUM | Separate ground planes; star grounding topology |
| CCF-03| EMC radiated interference | YES | YES | MEDIUM | Separate PCB areas; metal shield between channels |
| CCF-04| Same software library (e.g., CRC)| YES | YES | HIGH | B uses different CRC implementation (diverse software) |
| CCF-05| Same clock source (crystal) | YES | YES | MEDIUM | Each MCU has independent XTAL; cross-monitoring of clock |
| CCF-06| PCB moisture/corrosion | YES | YES | LOW | Conformal coating; channel separation ≥ 5 mm |
| CCF-07| Firmware update error | YES | YES | MEDIUM | Independent update paths; update one at a time |
| CCF-08| Same compiler/toolchain | YES | YES | LOW | Different compilers (GCC vs IAR) for channels (diverse) |
## 3. Independence Evidence Summary
✓ Separate power regulators (verified: two TPS65381 per channel)
✓ Separate PCBs (channels on different circuit boards)
✓ No shared software code (verified by DIF tool; 0% shared code)
✓ Separate development teams (Channel B by external Tier-1 supplier)
✓ EMC shield between channels (metal barrier on PCB)
⚠ Clock: mitigated but not fully independent — cross-monitor clocks (CM-01 required)
## 4. Residual CCF Risk
After mitigations: residual CCF rate estimated at 1e-9/h (bounded assumption)
→ Acceptable for ASIL-D decomposition (residual < contribution budget)| Independence Measure | Addresses CCF Type | Implementation |
|---|---|---|
| Physical separation | EMC, thermal, moisture | ≥ 5 mm PCB separation; separate PCBs; metal shields |
| Separate power supply | Supply undervoltage/overvoltage | Independent LDO per channel; each monitors own supply |
| Diverse hardware | Design commonality | Different MCU families for Channel A and B |
| Diverse software | Common design fault | Different design teams; different algorithms; different coding language |
| Diverse compiler | Toolchain systematic fault | GCC for Channel A; IAR or LLVM for Channel B |
| Separate development process | Process error | Different engineers; separate code reviews; separate V&V |
| Environmental testing | Temperature, humidity, vibration | Both channels tested independently to AEC-Q100 Grade 0 |
DFA is mandatory for ASIL-D systems with redundant channels (ISO 26262 Part 9 Clause 10). The analysis must be documented with objective evidence for each independence claim — a statement that 'the two channels are independent' without supporting evidence is not acceptable. The most commonly overlooked CCF is a shared software library: developers often assume two independently-developed components are diverse, but both use the same third-party CRC or communication stack, creating a shared systematic failure mode. Tool-based code similarity analysis (DIF — Diverse Implementation Finder) is increasingly used to objectively measure code diversity between channels.
This section builds on the foundational concepts covered above with additional technical depth, edge cases, and configuration nuances that separate competent engineers from experts. When working on production ECU projects, the details covered here are the ones most commonly responsible for integration delays and late-phase defects.
Key principles to reinforce:
Engineers who master both the theoretical concepts and the practical toolchain skills covered in this course are among the most sought-after professionals in the automotive software industry. The combination of AUTOSAR standards knowledge, safety engineering understanding, and hands-on configuration experience commands premium salaries at OEMs and Tier-1 suppliers globally.