https://www.mdu.se/

Connected and AutomatedD riving (CAD) features rely on s e v er al key technologies to function safelyat the vehicle and compone nt level. HEADSTART (Harm onised European Solutions fo r TestingAutomated Road Transport) is a research project fund ed by the European Union tha t aims to definetesting and validation pro c e d ur e s for CAD features with a focus on three K ey Enabling Technologi es(KETs): Vehicle to eve rything (V2X) communication, Positioning and Cyber security. This paperpresent s the technical and functional requ i rements for these three KETs including w h a t is n e eded forthese technol ogies to work corre ctly (at vehicle and c omponent level) and what is needed to verify andvali d ate them in proving ground and simulation environment. The final aim is to satisfy t h e safetyrequirements to protect the veh i c l e i ts e lf and the other road users.

The complexity of developing embedded electronic systems has been increasing especially in the automotive domain due to recently added functional requirements concerning e.g., connectivity. The development of these systems becomes even more complex for products - such as connected automated driving systems – where several different quality attributes (such as functional safety and cybersecurity) need to also be taken into account. In these cases, there is often a need to adhere to several standards simultaneously, each addressing a unique quality attribute. In this paper, we analyze potential synergies when working with both a functional safety standard (ISO 26262) and a cybersecurity standard (first working draft of ISO/SAE 21434). The analysis is based on a use case developing a positioning component for the automotive domain. The results regarding the use of multi-concern development lifecycle is on a high level, since most of the insights into co-engineering presented in this paper is based on process modeling. The main findings of our analysis show that on the design-side of the development lifecycle, the big gain is completeness of the analysis when considering both attributes together, but the overlap in terms of shared activities is small. For the verification-side of the lifecycle, much of the work and infrastructure can be shared when showing fulfillment of the two standards ISO 26262 and ISO/SAE 21434.

Showing that dependable embedded systems fulfil vital quality attributes, e.g. by conforming to relevant standards, can be challenging. For emerging and increasingly complex functions, such as connected automated driving (CAD), there is also a need to ensure that attributes such as safety, cybersecurity, and availability are fulfilled simultaneously. Furthermore, such systems are often designed using existing parts, including 3rd party components, which must be included in the quality assurance. This paper discusses how to structure the argument at the core of an assurance case taking these considerations into account, and proposes patterns to aid in this task. The patterns are applied in a case study with an example automotive function. While the aim has primarily been safety and security assurance of CAD, their generic nature make the patterns relevant for multi-concern assurance in general.

Standardisation has a primary role in establishing common ground and providing technical guidance on best practices. However, as the methods for Autonomous Driving Systems design, validation and assurance are still in their initial stages, and several of the standards are under development or have been recently published, an established practice for how to work with several complementary standards simultaneously is still lacking. To bridge this gap, we present a unified chart describing the processes, artefacts, and activities for three road vehicle standards addressing different concerns: ISO 26262 - functional safety, ISO 21448 - safety of the intended functionality, and ISO 21434 - cybersecurity engineering. In particular, the need to ensure alignment between the concerns is addressed with a synchronisation structure regarding content and timing.

An evaluation of safety and security properties performed by an independent organisation can be an important step towards establishing trust in Automated Driving Systems (ADS), bridging the gap between the marketing portrayal and the actual performance of such systems in real operating conditions. However, due to the complexity of an ADS's behaviour and dangers involved in performing real environment security attacks, we believe assessments that can be performed with a combination of simulation and validation at test facilities is the way forward.In this paper, we outline an approach to derive test suites applicable to generic ADS feature classes, where classes would have similar capabilities and comparable assessment results. The goal is to support black box testing of such feature classes as part of an independent evaluation. By the means of co-simulation of post-attack behaviour and critical scenarios, we derive a representative set of physical certification tests, to gain an understanding of the interplay between safety and security. During the initial tests an ADS is subjected to various attacks and its reactions recorded. These reactions such as reduced functionality, fall back etc., together with relevant scenarios for the class is further analysed to check for safety implications.