Commission Regulation (EU) No 347/2012Show full title

3.4. Safety concept of the manufacturer

3.4.1. The manufacturer shall provide a statement which affirms that the strategy chosen to achieve ‘the System’ objectives will not, under non-fault conditions, prejudice the safe operation of systems which are subject to the provisions of this Regulation.

3.4.2. In respect of software used in ‘the System’, the outline architecture shall be explained and the design methods and tools used shall be identified. The manufacturer shall be prepared, if required, to show evidence of the means by which the realisation of the system logic has been determined during the design and development process.

3.4.3. The manufacturer shall provide the technical authorities with an explanation of the design provisions built into ‘the System’ so as to generate safe operation under fault conditions. Possible design provisions for failure in ‘the System’ are for example:

(a)

fall-back to operation using a partial system;

(b)

change-over to a separate back-up system;

(c)

removal of the high level function.

In case of a failure, the driver shall be warned for example by warning signal or message display. When the system is not deactivated by the driver, e.g. by turning the ignition (run) switch to ‘off’, or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.

3.4.3.1. If the chosen provision selects a partial performance mode of operation under certain fault conditions, then those conditions shall be stated and the resulting limits of effectiveness defined.

3.4.3.2. If the chosen provision selects a second (back-up) means to realise the vehicle control system objective, the principles of the change-over mechanism, the logic and level of redundancy and any built in back-up checking features shall be explained and the resulting limits of back-up effectiveness defined.

3.4.3.3. If the chosen provision selects the removal of the higher level function, all the corresponding output control signals associated with this function shall be inhibited, and in such a manner as to limit the transition disturbance.

3.4.4. The documentation shall be supported, by an analysis which shows, in overall terms, how the system will behave on the occurrence of any one of those specified faults which will have a bearing on vehicle control performance or safety.

This may be based on a Failure Mode and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) or any similar process appropriate to system safety considerations.

The chosen analytical approach(es) shall be established and maintained by the manufacturer and shall be made open for inspection by the technical service at the time of the type-approval.

3.4.4.1. This documentation shall itemise the parameters being monitored and shall set out, for each fault condition of the type referred to in point 3.4.4, the warning signal to be given to the driver and/or to service/technical inspection personnel.