🎓 Lesson 8
D5
ISO 26262 ASIL-B Compliance for Obstacle Detection
ASIL-B is a safety level that tells engineers how carefully an autonomous haul truck’s obstacle detection system must be designed and tested to prevent dangerous failures.
🎯 Learning Objectives
- ✓ Explain the ASIL determination process for an obstacle detection function using HARA methodology
- ✓ Analyze a LiDAR-based perception architecture to identify ASIL-B compliance gaps in hardware redundancy and diagnostic coverage
- ✓ Apply ISO 26262-5 and -6 requirements to design a fault-tolerant sensor fusion workflow for object classification
- ✓ Calculate diagnostic coverage (DC) and single-point fault metric (SPFM) for a dual-LiDAR + radar perception subsystem
📖 Why This Matters
In autonomous haul trucks operating 24/7 in remote, GPS-denied, dust-laden open-pit mines, obstacle detection isn’t just about avoiding collisions—it’s the primary barrier against catastrophic incidents involving personnel, infrastructure, or other equipment. A single undetected false negative (e.g., missing a stationary service vehicle behind dust plume) can trigger chain-reaction hazards with no driver override. ASIL-B compliance ensures that the detection system has rigorously validated fault detection, safe state transitions, and sufficient redundancy—not as theoretical ideals, but as auditable engineering deliverables required by mine operators (e.g., Rio Tinto, BHP), OEMs (Caterpillar, Komatsu), and regulatory bodies like MSHA and Australia’s DMIRS.
📘 Core Principles
ASIL assignment begins with Hazard Analysis and Risk Assessment (HARA), evaluating severity (S), exposure (E), and controllability (C) per ISO 26262-3. For obstacle detection in AHS, S3 (life-threatening injury) is typical; E4 (frequent operation in hazardous zones) and C2 (reduced controllability due to limited operator intervention time) yield ASIL-B. ASIL-B imposes strict requirements: ≥90% diagnostic coverage for single-point faults, SPFM ≥ 97%, latent fault metric (LFM) ≥ 90%, and mandatory hardware-level fault tolerance (e.g., dual independent sensors or cross-monitoring). Crucially, ISO 26262-10 clarifies that ASIL decomposition (e.g., splitting ASIL-B across two ASIL-A elements) is permissible only if independence is proven via physical separation, diverse algorithms, and freedom from interference (FFI)—a key challenge in tightly integrated AHS perception stacks.
📐 Single-Point Fault Metric (SPFM) Calculation
SPFM quantifies the proportion of single-point faults detected and mitigated before causing a hazardous event. It is calculated per ISO 26262-5 Annex D and is mandatory for ASIL-B (≥97%). The metric applies at the hardware element level (e.g., LiDAR receiver IC, FPGA logic block) and requires traceable fault injection and diagnostic test coverage evidence.
SPFM (Single-Point Fault Metric)
SPFM = (N_detected_SPF / N_total_SPF) × 100Measures effectiveness of safety mechanisms in detecting and handling single-point hardware faults.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| N_detected_SPF | Number of detected single-point faults | count | Faults identified and mitigated by diagnostics (e.g., BIST, CRC, watchdog) |
| N_total_SPF | Total number of single-point faults | count | All faults that could lead directly to violation of safety goal without latent or safe behavior |
Typical Ranges:
ASIL-B compliant perception ECU: 97.0 – 99.5%
ASIL-A baseline reference: 80 – 90%
💡 Worked Example
Problem: A perception ECU uses a Velodyne VLP-32C LiDAR (32-channel) and TI AWR2944 mmWave radar. During FMEDA, 217 total hardware faults were identified in the LiDAR’s signal processing ASIC. Of these, 209 are detectable via built-in self-test (BIST) and reported via CAN FD error frames within <100 ms; 5 are safely masked (no impact on output); 3 are undetectable single-point faults.
1.
Step 1: Identify total single-point faults = total faults − latent faults − safe faults = 217 − 0 − 5 = 212
2.
Step 2: Identify detected single-point faults = 209
3.
Step 3: Compute SPFM = (detected SPFs / total SPFs) × 100 = (209 / 212) × 100 = 98.58%
Answer:
The result is 98.58%, which exceeds the ASIL-B minimum requirement of 97% and falls within the safe range of 97–100%.
🏗️ Real-World Application
At Newmont’s Boddington Mine (Western Australia), the autonomous fleet upgrade to Cat Command for Hauling v3.0 required ASIL-B certification of the new multi-sensor obstacle detection suite (1× mechanical LiDAR + 2× solid-state LiDAR + 1× long-range radar). To meet ASIL-B, engineers implemented triple modular redundancy (TMR) voting for static obstacle classification, introduced hardware-isolated watchdog timers per sensor interface, and performed >12,000 hours of fault injection testing using dSPACE SCALEXIO hardware-in-the-loop (HIL) rigs. Certification was granted by TÜV SÜD after independent audit confirmed DC ≥ 92.3% for radar RF front-end faults and SPFM = 98.1% for the central perception SoC—validating compliance without over-engineering redundant compute layers.