Safety ASIL goal for Adaptive AUTOSAR?

Question

There's a well comparison between AUTOSAR classic (CP) and adaptive (AP)

(Src: embitel.com)

The Classic Platform is ideally suited for functional ECUs. These are characterized by hard real-time (with deadlines potentially in microsecond range and where meeting all deadlines can be critical to correct operation of the ECU) with strong safety requirements — ASIL-D.

The Adaptive Platform is characterized by soft real-time (deadlines in the millisecond range and occasional missed deadlines are not catastrophic) and some safety requirements — ASIL-B.

How can AP implementations choose to be conformant to higher ASIL, for example, ASIL-D? Is it possible?

Answer 1

To answer in short words:

• Always look at it first from the high level safety goal for the function.
• It is very difficult to have an overall function satisfying ASIL D requirement through pure Adaptive implementation.
• Established industry practice is then to decompose the implementation with different safety channels (for example 2 ASIL B(D) (you have to show that they are independent)).

Here we are talking about a feature which, through safety analysis, has been allocated ASIL D and has to be implemented by software running on a software platform, running on a chip, running on a hardware platform.

Classic (safety MCU based) platforms are well designed in regard to having ASIL D SW solution overall (static, deterministic). The challenge in Classic is that it does not scale for the latest requirements in industry (e.g. AD/ADAS).

With Adaptive the state of the art requirements are satisfied but this brings the points of the performance hardware platform. Adaptive runs on POSIX-based OS on top of a performance processor. The processor supports MMU (memory management unit), virtualization, caching which make sense at this scale but mess up deterministic execution (ASIL D) and can get you to ASIL B.

A robust solution in the industry you see very often is to decompose a complex system into multiple manageable redundant chains-of-effect i.e.:

• Independent ASIL B(D) + ASIL B(D) fed into an ASIL D arbiter
• ASIL B(D) + ASIL D(D) where the D is arbiter as well

(Where you read B - you read Adaptive, where D - Classic. ASIL B(D) - ASIL B with the goal of D)

Disclaimer: The answer is from personal experience and is highly subjective