engines={image=false textcolor=true vector=false text=true} tetml={filename={D:\drim\repository\projects\drim_124_0\metadata\5\a\5a46d4fcf0efbd5e49f61d02ecf4d3a1\5a46d4fcf0efbd5e49f61d02ecf4d3a1.para.xml} elements={annotations=false bookmarks=false destinations=false fields=false javascripts=false} }
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
INTERNATIONAL
I
N
T
E
R
N
A
T
I
O
N
A
L
ISO
I
S
O
STANDARD
S
T
A
N
D
A
R
D
26262-6
2
6
2
6
2
-
6
First
F
i
r
s
t
edition
e
d
i
t
i
o
n
2011-11-15
2
0
1
1
-
1
1
-
1
5
OSS
O
S
S
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
—
—
Part
P
a
r
t
6:
6
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
Véhicules
V
é
h
i
c
u
l
e
s
routiers
r
o
u
t
i
e
r
s
—
—
Sécurité
S
é
c
u
r
i
t
é
fonctionnelle
f
o
n
c
t
i
o
n
n
e
l
l
e
—
—
Partie
P
a
r
t
i
e
6:
6
:
Développement
D
é
v
e
l
o
p
p
e
m
e
n
t
du
d
u
produit
p
r
o
d
u
i
t
au
a
u
niveau
n
i
v
e
a
u
dulogiciel
d
u
l
o
g
i
c
i
e
l
ma
m
a
SNS
S
N
S
=
=
Reference
R
e
f
e
r
e
n
c
e
number
n
u
m
b
e
r
|
|
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
COPYRIGHT
C
O
P
Y
R
I
G
H
T
PROTECTED
P
R
O
T
E
C
T
E
D
DOCUMENT
D
O
C
U
M
E
N
T
©
©
180
1
8
0
2011
2
0
1
1
All
A
l
l
rights
r
i
g
h
t
s
reserved.
r
e
s
e
r
v
e
d
.
Unless
U
n
l
e
s
s
otherwise
o
t
h
e
r
w
i
s
e
specified,
s
p
e
c
i
f
i
e
d
,
no
n
o
part
p
a
r
t
of
o
f
this
t
h
i
s
publication
p
u
b
l
i
c
a
t
i
o
n
may
m
a
y
be
b
e
reproduced
r
e
p
r
o
d
u
c
e
d
orutilized
o
r
u
t
i
l
i
z
e
d
in
i
n
any
a
n
y
form
f
o
r
m
or
o
r
by
b
y
any
a
n
y
means,
m
e
a
n
s
,
electronic
e
l
e
c
t
r
o
n
i
c
or
o
r
mechanical,
m
e
c
h
a
n
i
c
a
l
,
including
i
n
c
l
u
d
i
n
g
photocopying
p
h
o
t
o
c
o
p
y
i
n
g
and
a
n
d
microfilm,
m
i
c
r
o
f
i
l
m
,
without
w
i
t
h
o
u
t
permission
p
e
r
m
i
s
s
i
o
n
in
i
n
writing
w
r
i
t
i
n
g
from
f
r
o
m
either
e
i
t
h
e
r
ISO
I
S
O
at
a
t
the
t
h
e
address
a
d
d
r
e
s
s
below
b
e
l
o
w
or
o
r
ISO's
I
S
O
'
s
member
m
e
m
b
e
r
bodyin
b
o
d
y
i
n
the
t
h
e
country
c
o
u
n
t
r
y
of
o
f
the
t
h
e
requester.
r
e
q
u
e
s
t
e
r
.
ISO
I
S
O
copyright
c
o
p
y
r
i
g
h
t
office
o
f
f
i
c
e
Case
C
a
s
e
postale
p
o
s
t
a
l
e
56
5
6
e
e
CH-1211
C
H
-
1
2
1
1
Geneva
G
e
n
e
v
a
20
2
0
Tel.
T
e
l
.
+41
+
4
1
22
2
2
74901
7
4
9
0
1
11
1
1
Fax
F
a
x
+41
+
4
1
22
2
2
749
7
4
9
09
0
9
47
4
7
E-mail
E
-
m
a
i
l
copyright@isv.org
c
o
p
y
r
i
g
h
t
@
i
s
v
.
o
r
g
Web
W
e
b
www.iso.org
w
w
w
.
i
s
o
.
o
r
g
Published
P
u
b
l
i
s
h
e
d
in
i
n
Switzerland
S
w
i
t
z
e
r
l
a
n
d
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
IILl
I
I
L
l
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Contents
C
o
n
t
e
n
t
s
Page
P
a
g
e
FROG
F
R
O
G
cuca
c
u
c
a
rasosvccsevwniteusneceieisstite
r
a
s
o
s
v
c
c
s
e
v
w
n
i
t
e
u
s
n
e
c
e
i
e
i
s
s
t
i
t
e
SMIALSGsAAACNEE
S
M
I
A
L
S
G
s
A
A
A
C
N
E
E
bEG
b
E
G
NN
N
N
Ninmiannonnasonensnsnansasesenarsenaemmuceenansuntearumenapsromnmauseneves
N
i
n
m
i
a
n
n
o
n
n
a
s
o
n
e
n
s
n
s
n
a
n
s
a
s
e
s
e
n
a
r
s
e
n
a
e
m
m
u
c
e
e
n
a
n
s
u
n
t
e
a
r
u
m
e
n
a
p
s
r
o
m
n
m
a
u
s
e
n
e
v
e
s
Vv
V
v
SINECONEnissan
S
I
N
E
C
O
N
E
n
i
s
s
a
n
reser
r
e
s
e
r
voassnapdae
v
o
a
s
s
n
a
p
d
a
e
upniteaaceiatpvnnenneanseonanenesnsonnnenmreneemmammeonswnntneunnataremtan
u
p
n
i
t
e
a
a
c
e
i
a
t
p
v
n
n
e
n
n
e
a
n
s
e
o
n
a
n
e
n
e
s
n
s
o
n
n
n
e
n
m
r
e
n
e
e
m
m
a
m
m
e
o
n
s
w
n
n
t
n
e
u
n
n
a
t
a
r
e
m
t
a
n
vuvmeiaen
v
u
v
m
e
i
a
e
n
se
s
e
sybetereesvewseuesumeve
s
y
b
e
t
e
r
e
e
s
v
e
w
s
e
u
e
s
u
m
e
v
e
creases
c
r
e
a
s
e
s
vi
v
i
A
A
SOG
S
O
G
ses
s
e
s
ssnvvinonnensuanunnnnnsninesiesavuunasesiiaistecanensesoannnnceneansnanansaenneanernenusssnenyiansenuannevaviteeirtmnuneeseurssonsesveavssnvevsce
s
s
n
v
v
i
n
o
n
n
e
n
s
u
a
n
u
n
n
n
n
n
s
n
i
n
e
s
i
e
s
a
v
u
u
n
a
s
e
s
i
i
a
i
s
t
e
c
a
n
e
n
s
e
s
o
a
n
n
n
n
c
e
n
e
a
n
s
n
a
n
a
n
s
a
e
n
n
e
a
n
e
r
n
e
n
u
s
s
s
n
e
n
y
i
a
n
s
e
n
u
a
n
n
e
v
a
v
i
t
e
e
i
r
t
m
n
u
n
e
e
s
e
u
r
s
s
o
n
s
e
s
v
e
a
v
s
s
n
v
e
v
s
c
e
1
1
2
2
RCHRTEAEVE
R
C
H
R
T
E
A
E
V
E
PERTsss
P
E
R
T
s
s
s
nccercairzncnasraccssssiciatisetnanssnnaonnennonasnananenaneonensanannansunsemernenaananvsuununenemnviversemveeceees
n
c
c
e
r
c
a
i
r
z
n
c
n
a
s
r
a
c
c
s
s
s
s
i
c
i
a
t
i
s
e
t
n
a
n
s
s
n
n
a
o
n
n
e
n
n
o
n
a
s
n
a
n
a
n
e
n
a
n
e
o
n
e
n
s
a
n
a
n
n
a
n
s
u
n
s
e
m
e
r
n
e
n
a
a
n
a
n
v
s
u
u
n
u
n
e
n
e
m
n
v
i
v
e
r
s
e
m
v
e
e
c
e
e
e
s
Z
Z
3
3
Terms,definitions
T
e
r
m
s
,
d
e
f
i
n
i
t
i
o
n
s
and
a
n
d
abbreviated
a
b
b
r
e
v
i
a
t
e
d
terms..............:ccsssssssesessessesescesescseessessscacsacscescsssscaceatsccececeecereeees
t
e
r
m
s
.
.
.
.
.
.
.
.
.
.
.
.
.
.
:
c
c
s
s
s
s
s
s
s
e
s
e
s
s
e
s
s
e
s
e
s
c
e
s
e
s
c
s
e
e
s
s
e
s
s
s
c
a
c
s
a
c
s
c
e
s
c
s
s
s
s
c
a
c
e
a
t
s
c
c
e
c
e
c
e
e
c
e
r
e
e
e
e
s
2
2
4
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
for
f
o
r
COMPLIANCE.
C
O
M
P
L
I
A
N
C
E
.
..........csssssssssesesesssessseseseseseseseseecscscscscecscscscscecesscscesssucecscacececeaessseesensacees
.
.
.
.
.
.
.
.
.
.
c
s
s
s
s
s
s
s
s
s
e
s
e
s
e
s
s
s
e
s
s
s
e
s
e
s
e
s
e
s
e
s
e
s
e
s
e
e
c
s
c
s
c
s
c
s
c
e
c
s
c
s
c
s
c
s
c
e
c
e
s
s
c
s
c
e
s
s
s
u
c
e
c
s
c
a
c
e
c
e
c
e
a
e
s
s
s
e
e
s
e
n
s
a
c
e
e
s
2
2
4.1
4
.
1
General
G
e
n
e
r
a
l
requirement
r
e
q
u
i
r
e
m
e
n
t
.........cscsssssssssssceccssescsssssssssesesseseescsessesesessccessesecsecsssecessusassasacacscceasescarsecaestsatenees
.
.
.
.
.
.
.
.
.
c
s
c
s
s
s
s
s
s
s
s
s
s
s
c
e
c
c
s
s
e
s
c
s
s
s
s
s
s
s
s
s
e
s
e
s
s
e
s
e
e
s
c
s
e
s
s
e
s
e
s
e
s
s
c
c
e
s
s
e
s
e
c
s
e
c
s
s
s
e
c
e
s
s
u
s
a
s
s
a
s
a
c
a
c
s
c
c
e
a
s
e
s
c
a
r
s
e
c
a
e
s
t
s
a
t
e
n
e
e
s
2
2
4.2
4
.
2
Interpretations
I
n
t
e
r
p
r
e
t
a
t
i
o
n
s
Of
O
f
tables...
t
a
b
l
e
s
.
.
.
.cceescesescssescssesessesecsesscscsesscsccecsecscsccacescasscsacscsassceacsusatuecacsusacaseaeeasacees
.
c
c
e
e
s
c
e
s
e
s
c
s
s
e
s
c
s
s
e
s
e
s
s
e
s
e
c
s
e
s
s
c
s
c
s
e
s
s
c
s
c
c
e
c
s
e
c
s
c
s
c
c
a
c
e
s
c
a
s
s
c
s
a
c
s
c
s
a
s
s
c
e
a
c
s
u
s
a
t
u
e
c
a
c
s
u
s
a
c
a
s
e
a
e
e
a
s
a
c
e
e
s
2
2
4.3
4
.
3
ASIL-dependentrequirements
A
S
I
L
-
d
e
p
e
n
d
e
n
t
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations.............:.:s:sscsscesessssssssceceeseseassceasescaceceaceseaces
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
.
.
.
.
.
.
.
.
.
.
.
.
.
:
.
:
s
:
s
s
c
s
s
c
e
s
e
s
s
s
s
s
s
s
s
c
e
c
e
e
s
e
s
e
a
s
s
c
e
a
s
e
s
c
a
c
e
c
e
a
c
e
s
e
a
c
e
s
3
3
5
5
Initiation
I
n
i
t
i
a
t
i
o
n
of
o
f
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
..............:.:cscsssssssssescesssscescsessceecenceacesceecencess
.
.
.
.
.
.
.
.
.
.
.
.
.
.
:
.
:
c
s
c
s
s
s
s
s
s
s
s
s
e
s
c
e
s
s
s
s
c
e
s
c
s
e
s
s
c
e
e
c
e
n
c
e
a
c
e
s
c
e
e
c
e
n
c
e
s
s
3
3
5.1
5
.
1
ODjeCHIVES
O
D
j
e
C
H
I
V
E
S
200...eee
2
0
0
.
.
.
e
e
e
eceeseeeeceeeeseeseeeeeesseacececsecosescescecssesseseeesseseeesesesacesscsusesscsceacessesccaseaceacerseeaceseaeeasees
e
c
e
e
s
e
e
e
e
c
e
e
e
e
s
e
e
s
e
e
e
e
e
e
s
s
e
a
c
e
c
e
c
s
e
c
o
s
e
s
c
e
s
c
e
c
s
s
e
s
s
e
s
e
e
e
s
s
e
s
e
e
e
s
e
s
e
s
a
c
e
s
s
c
s
u
s
e
s
s
c
s
c
e
a
c
e
s
s
e
s
c
c
a
s
e
a
c
e
a
c
e
r
s
e
e
a
c
e
s
e
a
e
e
a
s
e
e
s
3
3
5.2
5
.
2
STORIE
S
T
O
R
I
E
essai
e
s
s
a
i
seicivttinanaocrencncenneanesnensansneninromennnneennem
s
e
i
c
i
v
t
t
i
n
a
n
a
o
c
r
e
n
c
n
c
e
n
n
e
a
n
e
s
n
e
n
s
a
n
s
n
e
n
i
n
r
o
m
e
n
n
n
n
e
e
n
n
e
m
eoremreamennancansanmienssrewecuutsananns
e
o
r
e
m
r
e
a
m
e
n
n
a
n
c
a
n
s
a
n
m
i
e
n
s
s
r
e
w
e
c
u
u
t
s
a
n
a
n
n
s
vi
v
i
kennseremupasentnanvevndnabassianrenianisiies
k
e
n
n
s
e
r
e
m
u
p
a
s
e
n
t
n
a
n
v
e
v
n
d
n
a
b
a
s
s
i
a
n
r
e
n
i
a
n
i
s
i
i
e
s
3
3
a3
a
3
INpUts
I
N
p
U
t
s
tO
t
O
this
t
h
i
s
ClAUSE
C
l
A
U
S
E
Qu...
Q
u
.
.
.
ecescseeseseeescescsceseesesscssessessessescenceaseneescenssesoessecesceesussuceessuceuceseesencesseceaseaceass
e
c
e
s
c
s
e
e
s
e
s
e
e
e
s
c
e
s
c
s
c
e
s
e
e
s
e
s
s
c
s
s
e
s
s
e
s
s
e
s
s
e
s
c
e
n
c
e
a
s
e
n
e
e
s
c
e
n
s
s
e
s
o
e
s
s
e
c
e
s
c
e
e
s
u
s
s
u
c
e
e
s
s
u
c
e
u
c
e
s
e
e
s
e
n
c
e
s
s
e
c
e
a
s
e
a
c
e
a
s
s
4
4
5.4
5
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations.
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
.
.............sscsscesscssssseessesseseccesceccesscnsesseaceascassecsesseacenseeasesaeeaceseees
.
.
.
.
.
.
.
.
.
.
.
.
.
s
s
c
s
s
c
e
s
s
c
s
s
s
s
s
e
e
s
s
e
s
s
e
s
e
c
c
e
s
c
e
c
c
e
s
s
c
n
s
e
s
s
e
a
c
e
a
s
c
a
s
s
e
c
s
e
s
s
e
a
c
e
n
s
e
e
a
s
e
s
a
e
e
a
c
e
s
e
e
e
s
4
4
5.5
5
.
5
WVOE
W
V
O
E
PIOGUCES
P
I
O
G
U
C
E
S
bx
b
x
caserescccecczezcessciscpponceccsocenacncsnoneorsncannronssoqnaospsecsceonsoancasccsnassaessasenssaasenacaneuseenspussecenessecruner
c
a
s
e
r
e
s
c
c
c
e
c
c
z
e
z
c
e
s
s
c
i
s
c
p
p
o
n
c
e
c
c
s
o
c
e
n
a
c
n
c
s
n
o
n
e
o
r
s
n
c
a
n
n
r
o
n
s
s
o
q
n
a
o
s
p
s
e
c
s
c
e
o
n
s
o
a
n
c
a
s
c
c
s
n
a
s
s
a
e
s
s
a
s
e
n
s
s
a
a
s
e
n
a
c
a
n
e
u
s
e
e
n
s
p
u
s
s
e
c
e
n
e
s
s
e
c
r
u
n
e
r
6
6
6
6
Specification
S
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requireMeNnts..............:ccsccsscesesesseescesecsssescececscseccesceessesseaseesseeseesees
r
e
q
u
i
r
e
M
e
N
n
t
s
.
.
.
.
.
.
.
.
.
.
.
.
.
.
:
c
c
s
c
c
s
s
c
e
s
e
s
e
s
s
e
e
s
c
e
s
e
c
s
s
s
e
s
c
e
c
e
c
s
c
s
e
c
c
e
s
c
e
e
s
s
e
s
s
e
a
s
e
e
s
s
e
e
s
e
e
s
e
e
s
6
6
6.1
6
.
1
CERNBM
C
E
R
N
B
M
sists
s
i
s
t
s
eeivi
e
e
i
v
i
sinsnnenrennrnenennsosenennnonsennepeenenenassensennanenaeasenananannannannnennnenensasanenannensennsennananneannenceees
s
i
n
s
n
n
e
n
r
e
n
n
r
n
e
n
e
n
n
s
o
s
e
n
e
n
n
n
o
n
s
e
n
n
e
p
e
e
n
e
n
e
n
a
s
s
e
n
s
e
n
n
a
n
e
n
a
e
a
s
e
n
a
n
a
n
a
n
n
a
n
n
a
n
n
n
e
n
n
n
e
n
e
n
s
a
s
a
n
e
n
a
n
n
e
n
s
e
n
n
s
e
n
n
a
n
a
n
n
e
a
n
n
e
n
c
e
e
e
s
6
6
6.2
6
.
2
Gee
G
e
e
rall
r
a
l
l
............ssesescsececssssscsorscssccssccsnscescrssecscssccessorescscecscscssesscncssoncssessescscanessesesssecscaseseccescssccsesccesccsccscs
.
.
.
.
.
.
.
.
.
.
.
.
s
s
e
s
e
s
c
s
e
c
e
c
s
s
s
s
s
c
s
o
r
s
c
s
s
c
c
s
s
c
c
s
n
s
c
e
s
c
r
s
s
e
c
s
c
s
s
c
c
e
s
s
o
r
e
s
c
s
c
e
c
s
c
s
c
s
s
e
s
s
c
n
c
s
s
o
n
c
s
s
e
s
s
e
s
c
s
c
a
n
e
s
s
e
s
e
s
s
s
e
c
s
c
a
s
e
s
e
c
c
e
s
c
s
s
c
c
s
e
s
c
c
e
s
c
c
s
c
c
s
c
s
7
7
6.3
6
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
CAUSE...eee
C
A
U
S
E
.
.
.
e
e
e
eeeceeeeeeeeensecesceesenceeseceesececesseeceseeccscecesseecensceeeneeceecanucesnaeeesesenseseesnecs
e
e
e
c
e
e
e
e
e
e
e
e
e
n
s
e
c
e
s
c
e
e
s
e
n
c
e
e
s
e
c
e
e
s
e
c
e
c
e
s
s
e
e
c
e
s
e
e
c
c
s
c
e
c
e
s
s
e
e
c
e
n
s
c
e
e
e
n
e
e
c
e
e
c
a
n
u
c
e
s
n
a
e
e
e
s
e
s
e
n
s
e
s
e
e
s
n
e
c
s
7
7
6.4
6
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recoMMendations
r
e
c
o
M
M
e
n
d
a
t
i
o
n
s
.............csccssscssscesscesecssecesesscecseesssseseeeeeeesseeseesaueeseeeeseeceeseeseesess
.
.
.
.
.
.
.
.
.
.
.
.
.
c
s
c
c
s
s
s
c
s
s
s
c
e
s
s
c
e
s
e
c
s
s
e
c
e
s
e
s
s
c
e
c
s
e
e
s
s
s
s
e
s
e
e
e
e
e
e
e
s
s
e
e
s
e
e
s
a
u
e
e
s
e
e
e
e
s
e
e
c
e
e
s
e
e
s
e
e
s
e
s
s
7
7
6.5
6
.
5
WOFK
W
O
F
K
Product.00....eee
P
r
o
d
u
c
t
.
0
0
.
.
.
.
e
e
e
eeecsssecesseecssecescecssecesseeecseeecsseeeessecesseeesesseceseeesseseesueceseeeecseeeceeseseseseecenseseneeeeees
e
e
e
c
s
s
s
e
c
e
s
s
e
e
c
s
s
e
c
e
s
c
e
c
s
s
e
c
e
s
s
e
e
e
c
s
e
e
e
c
s
s
e
e
e
e
s
s
e
c
e
s
s
e
e
e
s
e
s
s
e
c
e
s
e
e
e
s
s
e
s
e
e
s
u
e
c
e
s
e
e
e
e
c
s
e
e
e
c
e
e
s
e
s
e
s
e
s
e
e
c
e
n
s
e
s
e
n
e
e
e
e
e
e
s
9
9
7
7
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
M@SIGN
M
@
S
I
G
N
..............cccscessceseeessseseeescesseeeeseeceeeseenteneeeseeseeceesseeaeeeeesaeeceeseeeseeseeeeseneees
.
.
.
.
.
.
.
.
.
.
.
.
.
.
c
c
c
s
c
e
s
s
c
e
s
e
e
e
s
s
s
e
s
e
e
e
s
c
e
s
s
e
e
e
e
s
e
e
c
e
e
e
s
e
e
n
t
e
n
e
e
e
s
e
e
s
e
e
c
e
e
s
s
e
e
a
e
e
e
e
e
s
a
e
e
c
e
e
s
e
e
e
s
e
e
s
e
e
e
e
s
e
n
e
e
e
s
9
9
7.1
7
.
1
ODjOCHIVES
O
D
j
O
C
H
I
V
E
S
000...
0
0
0
.
.
.
eeeeceteteeeeeeessssssneeeeeesesssensececeseessenaeeeeeceeeeesesauaeseseceesesaaesessceceseneuaeseesseuseneueeeeeeseneeeaaes
e
e
e
e
c
e
t
e
t
e
e
e
e
e
e
e
s
s
s
s
s
s
n
e
e
e
e
e
e
s
e
s
s
s
e
n
s
e
c
e
c
e
s
e
e
s
s
e
n
a
e
e
e
e
e
c
e
e
e
e
e
s
e
s
a
u
a
e
s
e
s
e
c
e
e
s
e
s
a
a
e
s
e
s
s
c
e
c
e
s
e
n
e
u
a
e
s
e
e
s
s
e
u
s
e
n
e
u
e
e
e
e
e
e
s
e
n
e
e
e
a
a
e
s
9
9
2
2
Gernerrall
G
e
r
n
e
r
r
a
l
l
..............scsscccssssssssccsesessssccccccccsenssnsccccccesessnsccceesessansnsceccesseceessacecsceccessesscaceccesessssecccsceseessesscccesees
.
.
.
.
.
.
.
.
.
.
.
.
.
.
s
c
s
s
c
c
c
s
s
s
s
s
s
s
s
c
c
s
e
s
e
s
s
s
s
c
c
c
c
c
c
c
c
s
e
n
s
s
n
s
c
c
c
c
c
c
e
s
e
s
s
n
s
c
c
c
e
e
s
e
s
s
a
n
s
n
s
c
e
c
c
e
s
s
e
c
e
e
s
s
a
c
e
c
s
c
e
c
c
e
s
s
e
s
s
c
a
c
e
c
c
e
s
e
s
s
s
s
e
c
c
c
s
c
e
s
e
e
s
s
e
s
s
c
c
c
e
s
e
e
s
9
9
7.3
7
.
3
IPPUCS
I
P
P
U
C
S
COL
C
O
L
CNIS!
C
N
I
S
!
CLAUSvesessececers
C
L
A
U
S
v
e
s
e
s
s
e
c
e
c
e
r
s
sescr
s
e
s
c
r
secs
s
e
c
s
ceicsnansanenonnsneuescdheceeseveneeabaluzebases
c
e
i
c
s
n
a
n
s
a
n
e
n
o
n
n
s
n
e
u
e
s
c
d
h
e
c
e
e
s
e
v
e
n
e
e
a
b
a
l
u
z
e
b
a
s
e
s
sub
s
u
b
ca
c
a
tacna
t
a
c
n
a
tember
t
e
m
b
e
r
an
a
n
aaa
a
a
a
eseneeveseES
e
s
e
n
e
e
v
e
s
e
E
S
9
9
7.4
7
.
4
Requirenionts:and
R
e
q
u
i
r
e
n
i
o
n
t
s
:
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
wvscsesecccczscesevversceeresssecsscscerseenearnaar
w
v
s
c
s
e
s
e
c
c
c
c
z
s
c
e
s
e
v
v
e
r
s
c
e
e
r
e
s
s
s
e
c
s
s
c
s
c
e
r
s
e
e
n
e
a
r
n
a
a
r
aarenTTReTNE
a
a
r
e
n
T
T
R
e
T
N
E
10
1
0
7.5
7
.
5
WOr
W
O
r
PROGUCTS
P
R
O
G
U
C
T
S
iss
i
s
s
sscoseossrcugsessscecassacerssarsesenersssuseatenexevacnancusaeesaszanstepesemanyencsssasscaeaven
s
s
c
o
s
e
o
s
s
r
c
u
g
s
e
s
s
s
c
e
c
a
s
s
a
c
e
r
s
s
a
r
s
e
s
e
n
e
r
s
s
s
u
s
e
a
t
e
n
e
x
e
v
a
c
n
a
n
c
u
s
a
e
e
s
a
s
z
a
n
s
t
e
p
e
s
e
m
a
n
y
e
n
c
s
s
s
a
s
s
c
a
e
a
v
e
n
tanuacaaseseveneevesesibeeseeees
t
a
n
u
a
c
a
a
s
e
s
e
v
e
n
e
e
v
e
s
e
s
i
b
e
e
s
e
e
e
e
s
15
1
5
8
8
Sottwareiunit
S
o
t
t
w
a
r
e
i
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
Implementation
I
m
p
l
e
m
e
n
t
a
t
i
o
n
sicesisccscecedssecswecerccsvecsarwsvsenssavenraasesecssssscensscssesecetecsessessseve
s
i
c
e
s
i
s
c
c
s
c
e
c
e
d
s
s
e
c
s
w
e
c
e
r
c
c
s
v
e
c
s
a
r
w
s
v
s
e
n
s
s
a
v
e
n
r
a
a
s
e
s
e
c
s
s
s
s
s
c
e
n
s
s
c
s
s
e
s
e
c
e
t
e
c
s
e
s
s
e
s
s
s
e
v
e
15
1
5
8.1
8
.
1
0)os
0
)
o
s
15
1
5
8.2
8
.
2
GON
G
O
N
Cfal
C
f
a
l
ciecnvscccstacasansnsvasesewsastagesessineweswveneviteewennaaweraarausawaauvs
c
i
e
c
n
v
s
c
c
c
s
t
a
c
a
s
a
n
s
n
s
v
a
s
e
s
e
w
s
a
s
t
a
g
e
s
e
s
s
i
n
e
w
e
s
w
v
e
n
e
v
i
t
e
e
w
e
n
n
a
a
w
e
r
a
a
r
a
u
s
a
w
a
a
u
v
s
taaueaTaceneuuesaaawesanslevanwcctvinerassunecceensensdreneeueye
t
a
a
u
e
a
T
a
c
e
n
e
u
u
e
s
a
a
a
w
e
s
a
n
s
l
e
v
a
n
w
c
c
t
v
i
n
e
r
a
s
s
u
n
e
c
c
e
e
n
s
e
n
s
d
r
e
n
e
e
u
e
y
e
15
1
5
8.3
8
.
3
INPULS!1O!
I
N
P
U
L
S
!
1
O
!
EIS!
E
I
S
!
CIAUSO
C
I
A
U
S
O
sce
s
c
e
scicscceescieesserstacssecesvasssssceeeswocessesewescecaccacwasneessscecounwepsewensussssscessavsvascsccsavescassvsccsees
s
c
i
c
s
c
c
e
e
s
c
i
e
e
s
s
e
r
s
t
a
c
s
s
e
c
e
s
v
a
s
s
s
s
s
c
e
e
e
s
w
o
c
e
s
s
e
s
e
w
e
s
c
e
c
a
c
c
a
c
w
a
s
n
e
e
s
s
s
c
e
c
o
u
n
w
e
p
s
e
w
e
n
s
u
s
s
s
s
s
c
e
s
s
a
v
s
v
a
s
c
s
c
c
s
a
v
e
s
c
a
s
s
v
s
c
c
s
e
e
s
16
1
6
8.4
8
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendatlon
r
e
c
o
m
m
e
n
d
a
t
l
o
n
rasisssscssedecesvieerswccczecasavcccevecncovenwersewansssuccnsseveesesssecesssssacceesesseenes
r
a
s
i
s
s
s
s
c
s
s
e
d
e
c
e
s
v
i
e
e
r
s
w
c
c
c
z
e
c
a
s
a
v
c
c
c
e
v
e
c
n
c
o
v
e
n
w
e
r
s
e
w
a
n
s
s
s
u
c
c
n
s
s
e
v
e
e
s
e
s
s
s
e
c
e
s
s
s
s
s
a
c
c
e
e
s
e
s
s
e
e
n
e
s
16
1
6
8.5
8
.
5
WOPK
W
O
P
K
DROGUCES
D
R
O
G
U
C
E
S
ies
i
e
s
escaiseccsscsadaauaccsanccans
e
s
c
a
i
s
e
c
c
s
s
c
s
a
d
a
a
u
a
c
c
s
a
n
c
c
a
n
s
wwensawenss
w
w
e
n
s
a
w
e
n
s
s
cuvsessvavenessosssosesscaveccscececstoasesvescuassuvssvousconsasconencosecarsescoransosces
c
u
v
s
e
s
s
v
a
v
e
n
e
s
s
o
s
s
s
o
s
e
s
s
c
a
v
e
c
c
s
c
e
c
e
c
s
t
o
a
s
e
s
v
e
s
c
u
a
s
s
u
v
s
s
v
o
u
s
c
o
n
s
a
s
c
o
n
e
n
c
o
s
e
c
a
r
s
e
s
c
o
r
a
n
s
o
s
c
e
s
18
1
8
9
9
SOTWaresu
S
O
T
W
a
r
e
s
u
nit
n
i
t
TeshNG
T
e
s
h
N
G
tavaacccesaccsessc
t
a
v
a
a
c
c
c
e
s
a
c
c
s
e
s
s
c
sss
s
s
s
cweinncorecesasarensovesesaweeencdcesoevecwssevavensteveeuaucuvesatausccocervonsenmocosursveennessens
c
w
e
i
n
n
c
o
r
e
c
e
s
a
s
a
r
e
n
s
o
v
e
s
e
s
a
w
e
e
e
n
c
d
c
e
s
o
e
v
e
c
w
s
s
e
v
a
v
e
n
s
t
e
v
e
e
u
a
u
c
u
v
e
s
a
t
a
u
s
c
c
o
c
e
r
v
o
n
s
e
n
m
o
c
o
s
u
r
s
v
e
e
n
n
e
s
s
e
n
s
19
1
9
9.1
9
.
1
ODOCUUVCS
O
D
O
C
U
U
V
C
S
are
a
r
e
cceccasscataecassccwstan
c
c
e
c
c
a
s
s
c
a
t
a
e
c
a
s
s
c
c
w
s
t
a
n
pa
p
a
caseanusct
c
a
s
e
a
n
u
s
c
t
ews
e
w
s
dapencesscattaasutanaaveteveriuatuceduewessevesatuassavecervevecsecrusvedurosssvuevsseenscsnsees
d
a
p
e
n
c
e
s
s
c
a
t
t
a
a
s
u
t
a
n
a
a
v
e
t
e
v
e
r
i
u
a
t
u
c
e
d
u
e
w
e
s
s
e
v
e
s
a
t
u
a
s
s
a
v
e
c
e
r
v
e
v
e
c
s
e
c
r
u
s
v
e
d
u
r
o
s
s
s
v
u
e
v
s
s
e
e
n
s
c
s
n
s
e
e
s
19
1
9
9.2
9
.
2
CONCAl
C
O
N
C
A
l
essiswossceveecescen
e
s
s
i
s
w
o
s
s
c
e
v
e
e
c
e
s
c
e
n
ten
t
e
n
dezeenisevavsrsavectnananieseaswsscesouuseseusvitsavavanvuaaesenccsscaceusseseusecsccceescensescscevessuarwavcanensensed
d
e
z
e
e
n
i
s
e
v
a
v
s
r
s
a
v
e
c
t
n
a
n
a
n
i
e
s
e
a
s
w
s
s
c
e
s
o
u
u
s
e
s
e
u
s
v
i
t
s
a
v
a
v
a
n
v
u
a
a
e
s
e
n
c
c
s
s
c
a
c
e
u
s
s
e
s
e
u
s
e
c
s
c
c
c
e
e
s
c
e
n
s
e
s
c
s
c
e
v
e
s
s
u
a
r
w
a
v
c
a
n
e
n
s
e
n
s
e
d
19
1
9
9.3
9
.
3
InpUts?to:
I
n
p
U
t
s
?
t
o
:
this:
t
h
i
s
:
ClaUSO
C
l
a
U
S
O
secs
s
e
c
s
cece
c
e
c
e
cesreactecsrctresecscareessoesawensawecsuesusscconsecssascusacessssescuswsesssedeusesecencecscesconsdconsonscosed
c
e
s
r
e
a
c
t
e
c
s
r
c
t
r
e
s
e
c
s
c
a
r
e
e
s
s
o
e
s
a
w
e
n
s
a
w
e
c
s
u
e
s
u
s
s
c
c
o
n
s
e
c
s
s
a
s
c
u
s
a
c
e
s
s
s
s
e
s
c
u
s
w
s
e
s
s
s
e
d
e
u
s
e
s
e
c
e
n
c
e
c
s
c
e
s
c
o
n
s
d
c
o
n
s
o
n
s
c
o
s
e
d
19
1
9
9.4
9
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
...................ssssccsscccscsscsssessssscesssssnncesssncecessscsccssssecseesssssceseess
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
s
s
s
s
c
c
s
s
c
c
c
s
c
s
s
c
s
s
s
e
s
s
s
s
s
c
e
s
s
s
s
s
n
n
c
e
s
s
s
n
c
e
c
e
s
s
s
c
s
c
c
s
s
s
s
e
c
s
e
e
s
s
s
s
s
c
e
s
e
e
s
s
19
1
9
9.5
9
.
5
WONG
W
O
N
G
ProdUCI
P
r
o
d
U
C
I
iri
i
r
i
svssevsssccticenescesttececwenatavacaseicesscasavataensassuversacsscentacecsusasossvbewoosssusateoveennsosesszecsensesenonsounesens
s
v
s
s
e
v
s
s
s
c
c
t
i
c
e
n
e
s
c
e
s
t
t
e
c
e
c
w
e
n
a
t
a
v
a
c
a
s
e
i
c
e
s
s
c
a
s
a
v
a
t
a
e
n
s
a
s
s
u
v
e
r
s
a
c
s
s
c
e
n
t
a
c
e
c
s
u
s
a
s
o
s
s
v
b
e
w
o
o
s
s
s
u
s
a
t
e
o
v
e
e
n
n
s
o
s
e
s
s
z
e
c
s
e
n
s
e
s
e
n
o
n
s
o
u
n
e
s
e
n
s
21
2
1
10
1
0
Softwaresinteg
S
o
f
t
w
a
r
e
s
i
n
t
e
g
ravioniand
r
a
v
i
o
n
i
a
n
d
KesGG
K
e
s
G
G
:-vce
:
-
v
c
e
sssccceccnccoressancrccccvesusecccncvesseusenesconcovscsuscoosonccncnacansscesasoassstossceten
s
s
s
c
c
c
e
c
c
n
c
c
o
r
e
s
s
a
n
c
r
c
c
c
c
v
e
s
u
s
e
c
c
c
n
c
v
e
s
s
e
u
s
e
n
e
s
c
o
n
c
o
v
s
c
s
u
s
c
o
o
s
o
n
c
c
n
c
n
a
c
a
n
s
s
c
e
s
a
s
o
a
s
s
s
t
o
s
s
c
e
t
e
n
22
2
2
10.1
1
0
.
1
ODISCTUVOS
O
D
I
S
C
T
U
V
O
S
ii
i
i
eventersvecscsnwsuswnseresseusvedsuh¥aessscsusecevssessereceverssararansnunjeneqsensnandst
e
v
e
n
t
e
r
s
v
e
c
s
c
s
n
w
s
u
s
w
n
s
e
r
e
s
s
e
u
s
v
e
d
s
u
h
¥
a
e
s
s
s
c
s
u
s
e
c
e
v
s
s
e
s
s
e
r
e
c
e
v
e
r
s
s
a
r
a
r
a
n
s
n
u
n
j
e
n
e
q
s
e
n
s
n
a
n
d
s
t
onseneeseoogsansoncanqasssianreonnsenasznasnssa
o
n
s
e
n
e
e
s
e
o
o
g
s
a
n
s
o
n
c
a
n
q
a
s
s
s
i
a
n
r
e
o
n
n
s
e
n
a
s
z
n
a
s
n
s
s
a
22
2
2
FO.2
F
O
.
2
Gomersrall
G
o
m
e
r
s
r
a
l
l
.............cccccesesesssscscsssnessrsnsscnsncacssnssascascesccsscnccncccccccccncccancsncssanccenccnsasconccsccasccsssccussessseusscesesessesse
.
.
.
.
.
.
.
.
.
.
.
.
.
c
c
c
c
c
e
s
e
s
e
s
s
s
s
c
s
c
s
s
s
n
e
s
s
r
s
n
s
s
c
n
s
n
c
a
c
s
s
n
s
s
a
s
c
a
s
c
e
s
c
c
s
s
c
n
c
c
n
c
c
c
c
c
c
c
c
c
n
c
c
c
a
n
c
s
n
c
s
s
a
n
c
c
e
n
c
c
n
s
a
s
c
o
n
c
c
s
c
c
a
s
c
c
s
s
s
c
c
u
s
s
e
s
s
s
e
u
s
s
c
e
s
e
s
e
s
s
e
s
s
e
22
2
2
10.3
1
0
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
Clause...
C
l
a
u
s
e
.
.
.
cece
c
e
c
e
sceeeseeeeeececesceeceseeccceesesssseccesnneeesssneceeessneeeseesaeeceesausesesuseeeseeeeeesseseeees
s
c
e
e
e
s
e
e
e
e
e
e
c
e
c
e
s
c
e
e
c
e
s
e
e
c
c
c
e
e
s
e
s
s
s
s
e
c
c
e
s
n
n
e
e
e
s
s
s
n
e
c
e
e
e
s
s
n
e
e
e
s
e
e
s
a
e
e
c
e
e
s
a
u
s
e
s
e
s
u
s
e
e
e
s
e
e
e
e
e
e
s
s
e
s
e
e
e
e
s
22
2
2
10.4
1
0
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recOMMendations
r
e
c
O
M
M
e
n
d
a
t
i
o
n
s
.............csscccecsssseeeeseneeeesseseeesssceecessseseesseneesnsseneesseeeanseessneeeas
.
.
.
.
.
.
.
.
.
.
.
.
.
c
s
s
c
c
c
e
c
s
s
s
s
e
e
e
e
s
e
n
e
e
e
e
s
s
e
s
e
e
e
s
s
s
c
e
e
c
e
s
s
s
e
s
e
e
s
s
e
n
e
e
s
n
s
s
e
n
e
e
s
s
e
e
e
a
n
s
e
e
s
s
n
e
e
e
a
s
23
2
3
10.5
1
0
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
............scssscssssssssssssssscssssnccsssccssccesccrssscessecccescscsssccscnsscencccssscussseusssocscscacossnccessserssscsssssaaes
.
.
.
.
.
.
.
.
.
.
.
.
s
c
s
s
s
c
s
s
s
s
s
s
s
s
s
s
s
s
s
s
s
c
s
s
s
s
n
c
c
s
s
s
c
c
s
s
c
c
e
s
c
c
r
s
s
s
c
e
s
s
e
c
c
c
e
s
c
s
c
s
s
s
c
c
s
c
n
s
s
c
e
n
c
c
c
s
s
s
c
u
s
s
s
e
u
s
s
s
o
c
s
c
s
c
a
c
o
s
s
n
c
c
e
s
s
s
e
r
s
s
s
c
s
s
s
s
s
a
a
e
s
25
2
5
11
1
1
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirement.............cccscesessessseseessesseessseeseneeeesseeeseeneneeeeaesneseeseneees
r
e
q
u
i
r
e
m
e
n
t
.
.
.
.
.
.
.
.
.
.
.
.
.
c
c
c
s
c
e
s
e
s
s
e
s
s
s
e
s
e
e
s
s
e
s
s
e
e
s
s
s
e
e
s
e
n
e
e
e
e
s
s
e
e
e
s
e
e
n
e
n
e
e
e
e
a
e
s
n
e
s
e
e
s
e
n
e
e
e
s
25
2
5
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
SE
S
E
REcers
R
E
c
e
r
s
ceenessnrmscenpnaremnaaeacueneiarteroasaiaiocisninenen
c
e
e
n
e
s
s
n
r
m
s
c
e
n
p
n
a
r
e
m
n
a
a
e
a
c
u
e
n
e
i
a
r
t
e
r
o
a
s
a
i
a
i
o
c
i
s
n
i
n
e
n
e
n
onrensrnneenennazensennenennemrenneereerennanannnnanenerenonsvinnsarieanncuents25
o
n
r
e
n
s
r
n
n
e
e
n
e
n
n
a
z
e
n
s
e
n
n
e
n
e
n
n
e
m
r
e
n
n
e
e
r
e
e
r
e
n
n
a
n
a
n
n
n
n
a
n
e
n
e
r
e
n
o
n
s
v
i
n
n
s
a
r
i
e
a
n
n
c
u
e
n
t
s
2
5
TE
T
E
SOTERApn
S
O
T
E
R
A
p
n
ecessrsnatsrovesnneerescmen
e
c
e
s
s
r
s
n
a
t
s
r
o
v
e
s
n
n
e
e
r
e
s
c
m
e
n
nnn
n
n
n
vais
v
a
i
s
saUatsecaACLU
s
a
U
a
t
s
e
c
a
A
C
L
U
Aiaadsistatbicaoneonanennnandannaranerensamnnennenenancnasenasinatussertansunandl25
A
i
a
a
d
s
i
s
t
a
t
b
i
c
a
o
n
e
o
n
a
n
e
n
n
n
a
n
d
a
n
n
a
r
a
n
e
r
e
n
s
a
m
n
n
e
n
n
e
n
e
n
a
n
c
n
a
s
e
n
a
s
i
n
a
t
u
s
s
e
r
t
a
n
s
u
n
a
n
d
l
2
5
19.3
1
9
.
3
Inputs
I
n
p
u
t
s
to
t
o
Tinbes
T
i
n
b
e
s
ClAUSO
C
l
A
U
S
O
sseccessessiissicississestnsnensencnennsnecsnseneccoresesasecenensvenersvoensnserensuenerersensvenseatneseszeassedensvavers25
s
s
e
c
c
e
s
s
e
s
s
i
i
s
s
i
c
i
s
s
i
s
s
e
s
t
n
s
n
e
n
s
e
n
c
n
e
n
n
s
n
e
c
s
n
s
e
n
e
c
c
o
r
e
s
e
s
a
s
e
c
e
n
e
n
s
v
e
n
e
r
s
v
o
e
n
s
n
s
e
r
e
n
s
u
e
n
e
r
e
r
s
e
n
s
v
e
n
s
e
a
t
n
e
s
e
s
z
e
a
s
s
e
d
e
n
s
v
a
v
e
r
s
2
5
11.4
1
1
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
.............scssssssesesesseseeescssesescsusecscscscscsscscscseacssacacevacenesensasaceaess26
.
.
.
.
.
.
.
.
.
.
.
.
.
s
c
s
s
s
s
s
s
e
s
e
s
e
s
s
e
s
e
e
e
s
c
s
s
e
s
e
s
c
s
u
s
e
c
s
c
s
c
s
c
s
c
s
s
c
s
c
s
c
s
e
a
c
s
s
a
c
a
c
e
v
a
c
e
n
e
s
e
n
s
a
s
a
c
e
a
e
s
s
2
6
11.5
1
1
.
5
Work
W
o
r
k
products...
p
r
o
d
u
c
t
s
.
.
.
sesseesssessssssesssssesescescseseseseesesesesessseceesesesesecsusesucecacsesacavecessscassuaceseacasacaceusavaseraresens27
s
e
s
s
e
e
s
s
s
e
s
s
s
s
s
s
e
s
s
s
s
s
e
s
e
s
c
e
s
c
s
e
s
e
s
e
s
e
e
s
e
s
e
s
e
s
e
s
s
s
e
c
e
e
s
e
s
e
s
e
s
e
c
s
u
s
e
s
u
c
e
c
a
c
s
e
s
a
c
a
v
e
c
e
s
s
s
c
a
s
s
u
a
c
e
s
e
a
c
a
s
a
c
a
c
e
u
s
a
v
a
s
e
r
a
r
e
s
e
n
s
2
7
AnnexA
A
n
n
e
x
A
(informative)
(
i
n
f
o
r
m
a
t
i
v
e
)
Overview
O
v
e
r
v
i
e
w
of
o
f
and
a
n
d
workflow
w
o
r
k
f
l
o
w
of
o
f
managementof
m
a
n
a
g
e
m
e
n
t
o
f
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
SOFtWare
S
O
F
t
W
a
r
e
lOVEI
l
O
V
E
I
«0.0...
«
0
.
0
.
.
.
ceescseceseessssesscseescecessessneeeeesssesseesaeesaeesaeesseeeaeseaeesseseeeceaseeseeeseeeseesseeeseeeeeeeseseseaeees28
c
e
e
s
c
s
e
c
e
s
e
e
s
s
s
s
e
s
s
c
s
e
e
s
c
e
c
e
s
s
e
s
s
n
e
e
e
e
e
s
s
s
e
s
s
e
e
s
a
e
e
s
a
e
e
s
a
e
e
s
s
e
e
e
a
e
s
e
a
e
e
s
s
e
s
e
e
e
c
e
a
s
e
e
s
e
e
e
s
e
e
e
s
e
e
s
s
e
e
e
s
e
e
e
e
e
e
e
s
e
s
e
s
e
a
e
e
e
s
2
8
Annex
A
n
n
e
x
B
B
(informative)
(
i
n
f
o
r
m
a
t
i
v
e
)
Model-based:
M
o
d
e
l
-
b
a
s
e
d
:
development..............:.s:csscessessesssessessssssessecseeseeeeceesenscsnccasenasensenessacensees31
d
e
v
e
l
o
p
m
e
n
t
.
.
.
.
.
.
.
.
.
.
.
.
.
.
:
.
s
:
c
s
s
c
e
s
s
e
s
s
e
s
s
s
e
s
s
e
s
s
s
s
s
s
e
s
s
e
c
s
e
e
s
e
e
e
e
c
e
e
s
e
n
s
c
s
n
c
c
a
s
e
n
a
s
e
n
s
e
n
e
s
s
a
c
e
n
s
e
e
s
3
1
Annex
A
n
n
e
x
C
C
(normative)
(
n
o
r
m
a
t
i
v
e
)
Software
S
o
f
t
w
a
r
e
COnfiguration...............sscssssessesssscsssssessesessesscsecescenceceseceseesceesesencesensescescasenses33
C
O
n
f
i
g
u
r
a
t
i
o
n
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
s
s
c
s
s
s
s
e
s
s
e
s
s
s
s
c
s
s
s
s
s
e
s
s
e
s
e
s
s
e
s
s
c
s
e
c
e
s
c
e
n
c
e
c
e
s
e
c
e
s
e
e
s
c
e
e
s
e
s
e
n
c
e
s
e
n
s
e
s
c
e
s
c
a
s
e
n
s
e
s
3
3
Annex
A
n
n
e
x
(informative)
(
i
n
f
o
r
m
a
t
i
v
e
)
Freedom
F
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
.............:csssssseseeseeeeseeees38
.
.
.
.
.
.
.
.
.
.
.
.
.
:
c
s
s
s
s
s
s
e
s
e
e
s
e
e
e
e
s
e
e
e
e
s
3
8
EEE
E
E
E
ere
e
r
e
rersyormsncermmsnemneseronesevediencerrraeseasEVENS
r
e
r
s
y
o
r
m
s
n
c
e
r
m
m
s
n
e
m
n
e
s
e
r
o
n
e
s
e
v
e
d
i
e
n
c
e
r
r
r
a
e
s
e
a
s
E
V
E
N
S
ERICTANS
E
R
I
C
T
A
N
S
TELSASOSE
T
E
L
S
A
S
O
S
E
SEROTEC
S
E
R
O
T
E
C
SATE
S
A
T
E
Seresenate!40
S
e
r
e
s
e
n
a
t
e
!
4
0
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Foreword
F
o
r
e
w
o
r
d
ISO
I
S
O
(the
(
t
h
e
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Organization
O
r
g
a
n
i
z
a
t
i
o
n
for
f
o
r
Standardization)
S
t
a
n
d
a
r
d
i
z
a
t
i
o
n
)
is
i
s
a
a
worldwide
w
o
r
l
d
w
i
d
e
federation
f
e
d
e
r
a
t
i
o
n
of
o
f
national
n
a
t
i
o
n
a
l
standards
s
t
a
n
d
a
r
d
s
bodies
b
o
d
i
e
s
(ISO
(
I
S
O
member
m
e
m
b
e
r
bodies).
b
o
d
i
e
s
)
.
The
T
h
e
work
w
o
r
k
of
o
f
preparing
p
r
e
p
a
r
i
n
g
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Standards
S
t
a
n
d
a
r
d
s
is
i
s
normally
n
o
r
m
a
l
l
y
carried
c
a
r
r
i
e
d
out
o
u
t
through
t
h
r
o
u
g
h
ISO
I
S
O
technical
t
e
c
h
n
i
c
a
l
committees.
c
o
m
m
i
t
t
e
e
s
.
Each
E
a
c
h
memberbody
m
e
m
b
e
r
b
o
d
y
interested
i
n
t
e
r
e
s
t
e
d
in
i
n
a
a
subject
s
u
b
j
e
c
t
for
f
o
r
which
w
h
i
c
h
a
a
technical
t
e
c
h
n
i
c
a
l
committee
c
o
m
m
i
t
t
e
e
has
h
a
s
been
b
e
e
n
established
e
s
t
a
b
l
i
s
h
e
d
has
h
a
s
the
t
h
e
right
r
i
g
h
t
to
t
o
be
b
e
represented
r
e
p
r
e
s
e
n
t
e
d
on
o
n
that
t
h
a
t
committee.
c
o
m
m
i
t
t
e
e
.
International
I
n
t
e
r
n
a
t
i
o
n
a
l
organizations,
o
r
g
a
n
i
z
a
t
i
o
n
s
,
governmental
g
o
v
e
r
n
m
e
n
t
a
l
and
a
n
d
non-governmental,
n
o
n
-
g
o
v
e
r
n
m
e
n
t
a
l
,
in
i
n
liaison
l
i
a
i
s
o
n
with
w
i
t
h
ISO,
I
S
O
,
also
a
l
s
o
take
t
a
k
e
part
p
a
r
t
in
i
n
the
t
h
e
work.
w
o
r
k
.
ISO
I
S
O
collaborates
c
o
l
l
a
b
o
r
a
t
e
s
closely
c
l
o
s
e
l
y
with
w
i
t
h
the
t
h
e
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Electrotechnical
E
l
e
c
t
r
o
t
e
c
h
n
i
c
a
l
Commission
C
o
m
m
i
s
s
i
o
n
(IEC)
(
I
E
C
)
on
o
n
all
a
l
l
matters
m
a
t
t
e
r
s
of
o
f
electrotechnical
e
l
e
c
t
r
o
t
e
c
h
n
i
c
a
l
standardization.
s
t
a
n
d
a
r
d
i
z
a
t
i
o
n
.
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Standards
S
t
a
n
d
a
r
d
s
are
a
r
e
drafted
d
r
a
f
t
e
d
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
the
t
h
e
rules
r
u
l
e
s
given
g
i
v
e
n
in
i
n
the
t
h
e
ISO/IEC
I
S
O
/
I
E
C
Directives,
D
i
r
e
c
t
i
v
e
s
,
Part
P
a
r
t
2.
2
.
The
T
h
e
main
m
a
i
n
task
t
a
s
k
of
o
f
technical
t
e
c
h
n
i
c
a
l
committees
c
o
m
m
i
t
t
e
e
s
is
i
s
to
t
o
prepare
p
r
e
p
a
r
e
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Standards.
S
t
a
n
d
a
r
d
s
.
Draft
D
r
a
f
t
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Standards
S
t
a
n
d
a
r
d
s
adopted
a
d
o
p
t
e
d
by
b
y
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
committees
c
o
m
m
i
t
t
e
e
s
are
a
r
e
circulated
c
i
r
c
u
l
a
t
e
d
to
t
o
the
t
h
e
member
m
e
m
b
e
r
bodies
b
o
d
i
e
s
for
f
o
r
voting.
v
o
t
i
n
g
.
Publication
P
u
b
l
i
c
a
t
i
o
n
as
a
s
an
a
n
International
I
n
t
e
r
n
a
t
i
o
n
a
l
Standard
S
t
a
n
d
a
r
d
requires
r
e
q
u
i
r
e
s
approval
a
p
p
r
o
v
a
l
by
b
y
at
a
t
least
l
e
a
s
t
75
7
5
%
%
of
o
f
the
t
h
e
memberbodies
m
e
m
b
e
r
b
o
d
i
e
s
casting
c
a
s
t
i
n
g
a
a
vote.
v
o
t
e
.
Attention
A
t
t
e
n
t
i
o
n
is
i
s
drawn
d
r
a
w
n
to
t
o
the
t
h
e
possibility
p
o
s
s
i
b
i
l
i
t
y
that
t
h
a
t
some
s
o
m
e
of
o
f
the
t
h
e
elements
e
l
e
m
e
n
t
s
of
o
f
this
t
h
i
s
document
d
o
c
u
m
e
n
t
may
m
a
y
be
b
e
the
t
h
e
subject
s
u
b
j
e
c
t
of
o
f
patent
p
a
t
e
n
t
rights.
r
i
g
h
t
s
.
ISO
I
S
O
shall
s
h
a
l
l
not
n
o
t
be
b
e
held
h
e
l
d
responsible
r
e
s
p
o
n
s
i
b
l
e
foridentifying
f
o
r
i
d
e
n
t
i
f
y
i
n
g
any
a
n
y
or
o
r
all
a
l
l
such
s
u
c
h
patentrights.
p
a
t
e
n
t
r
i
g
h
t
s
.
ISO
I
S
O
26262-6
2
6
2
6
2
-
6
was
w
a
s
prepared
p
r
e
p
a
r
e
d
by
b
y
Technical
T
e
c
h
n
i
c
a
l
Committee
C
o
m
m
i
t
t
e
e
ISO/TC
I
S
O
/
T
C
22,
2
2
,
Road
R
o
a
d
vehicles,
v
e
h
i
c
l
e
s
,
Subcommittee
S
u
b
c
o
m
m
i
t
t
e
e
SC
S
C
3,
3
,
Electrical
E
l
e
c
t
r
i
c
a
l
and
a
n
d
electronic
e
l
e
c
t
r
o
n
i
c
equipment.
e
q
u
i
p
m
e
n
t
.
ISO
I
S
O
26262
2
6
2
6
2
consists
c
o
n
s
i
s
t
s
of
o
f
the
t
h
e
following
f
o
l
l
o
w
i
n
g
parts,
p
a
r
t
s
,
under
u
n
d
e
r
the
t
h
e
generaltitle
g
e
n
e
r
a
l
t
i
t
l
e
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functionalsafety:
F
u
n
c
t
i
o
n
a
l
s
a
f
e
t
y
:
—
—
Part
P
a
r
t
1:
1
:
Vocabulary
V
o
c
a
b
u
l
a
r
y
—
—
Part
P
a
r
t
2:
2
:
Managementof
M
a
n
a
g
e
m
e
n
t
o
f
functional
f
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
—
—
Part
P
a
r
t
3:
3
:
Concept
C
o
n
c
e
p
t
phase
p
h
a
s
e
—
—
Part
P
a
r
t
4:
4
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
—
—
Part
P
a
r
t
5:
5
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
hardware
h
a
r
d
w
a
r
e
level
l
e
v
e
l
—
—
Part
P
a
r
t
6:
6
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
—
—
Part
P
a
r
t
7:
7
:
Production
P
r
o
d
u
c
t
i
o
n
and
a
n
d
operation
o
p
e
r
a
t
i
o
n
—
—
Part
P
a
r
t
8:
8
:
Supporting
S
u
p
p
o
r
t
i
n
g
processes
p
r
o
c
e
s
s
e
s
—
—
Part
P
a
r
t
9:
9
:
Automotive
A
u
t
o
m
o
t
i
v
e
Safety
S
a
f
e
t
y
Integrity
I
n
t
e
g
r
i
t
y
Level
L
e
v
e
l
(ASIL)-oriented
(
A
S
I
L
)
-
o
r
i
e
n
t
e
d
and
a
n
d
safety-oriented
s
a
f
e
t
y
-
o
r
i
e
n
t
e
d
analyses
a
n
a
l
y
s
e
s
—
—
Part
P
a
r
t
10:
1
0
:
Guideline
G
u
i
d
e
l
i
n
e
on
o
n
ISO
I
S
O
26262
2
6
2
6
2
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Introduction
I
n
t
r
o
d
u
c
t
i
o
n
ISO
I
S
O
26262is
2
6
2
6
2
i
s
the
t
h
e
adaptation
a
d
a
p
t
a
t
i
o
n
of
o
f
IEC
I
E
C
61508
6
1
5
0
8
to
t
o
comply
c
o
m
p
l
y
with
w
i
t
h
needs
n
e
e
d
s
specific
s
p
e
c
i
f
i
c
to
t
o
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
sector
s
e
c
t
o
r
of
o
f
electrical
e
l
e
c
t
r
i
c
a
l
and/orelectronic
a
n
d
/
o
r
e
l
e
c
t
r
o
n
i
c
(E/E)
(
E
/
E
)
systems
s
y
s
t
e
m
s
within
w
i
t
h
i
n
road
r
o
a
d
vehicles.
v
e
h
i
c
l
e
s
.
This
T
h
i
s
adaptation
a
d
a
p
t
a
t
i
o
n
applies
a
p
p
l
i
e
s
to
t
o
all
a
l
l
activities
a
c
t
i
v
i
t
i
e
s
during
d
u
r
i
n
g
the
t
h
e
safety
s
a
f
e
t
y
lifecycle
l
i
f
e
c
y
c
l
e
of
o
f
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
systems
s
y
s
t
e
m
s
comprised
c
o
m
p
r
i
s
e
d
of
o
f
electrical,
e
l
e
c
t
r
i
c
a
l
,
electronic
e
l
e
c
t
r
o
n
i
c
and
a
n
d
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
Safety
S
a
f
e
t
y
is
i
s
one
o
n
e
of
o
f
the
t
h
e
key
k
e
y
issues
i
s
s
u
e
s
of
o
f
future
f
u
t
u
r
e
automobile
a
u
t
o
m
o
b
i
l
e
development.
d
e
v
e
l
o
p
m
e
n
t
.
Newfunctionalities
N
e
w
f
u
n
c
t
i
o
n
a
l
i
t
i
e
s
not
n
o
t
only
o
n
l
y
in
i
n
areas
a
r
e
a
s
such
s
u
c
h
as
a
s
driver
d
r
i
v
e
r
assistance,
a
s
s
i
s
t
a
n
c
e
,
propulsion,
p
r
o
p
u
l
s
i
o
n
,
in
i
n
vehicle
v
e
h
i
c
l
e
dynamics
d
y
n
a
m
i
c
s
control
c
o
n
t
r
o
l
and
a
n
d
active
a
c
t
i
v
e
and
a
n
d
passive
p
a
s
s
i
v
e
safety
s
a
f
e
t
y
systems
s
y
s
t
e
m
s
increasingly
i
n
c
r
e
a
s
i
n
g
l
y
touch
t
o
u
c
h
the
t
h
e
domain
d
o
m
a
i
n
of
o
f
system
s
y
s
t
e
m
safety
s
a
f
e
t
y
engineering.
e
n
g
i
n
e
e
r
i
n
g
.
Development
D
e
v
e
l
o
p
m
e
n
t
and
a
n
d
integration
i
n
t
e
g
r
a
t
i
o
n
of
o
f
these
t
h
e
s
e
functionalities
f
u
n
c
t
i
o
n
a
l
i
t
i
e
s
will
w
i
l
l
strengthen
s
t
r
e
n
g
t
h
e
n
the
t
h
e
need
n
e
e
d
for
f
o
r
safe
s
a
f
e
system
s
y
s
t
e
m
development
d
e
v
e
l
o
p
m
e
n
t
processes
p
r
o
c
e
s
s
e
s
and
a
n
d
the
t
h
e
need
n
e
e
d
to
t
o
provide
p
r
o
v
i
d
e
evidencethat
e
v
i
d
e
n
c
e
t
h
a
t
all
a
l
l
reasonable
r
e
a
s
o
n
a
b
l
e
system
s
y
s
t
e
m
safety
s
a
f
e
t
y
objectives
o
b
j
e
c
t
i
v
e
s
are
a
r
e
satisfied.
s
a
t
i
s
f
i
e
d
.
With
W
i
t
h
the
t
h
e
trend
t
r
e
n
d
of
o
f
increasing
i
n
c
r
e
a
s
i
n
g
technological
t
e
c
h
n
o
l
o
g
i
c
a
l
complexity,
c
o
m
p
l
e
x
i
t
y
,
software
s
o
f
t
w
a
r
e
content
c
o
n
t
e
n
t
and
a
n
d
mechatronic
m
e
c
h
a
t
r
o
n
i
c
implementation,
i
m
p
l
e
m
e
n
t
a
t
i
o
n
,
there
t
h
e
r
e
are
a
r
e
increasing
i
n
c
r
e
a
s
i
n
g
risks
r
i
s
k
s
from
f
r
o
m
systematic
s
y
s
t
e
m
a
t
i
c
failures
f
a
i
l
u
r
e
s
and
a
n
d
random
r
a
n
d
o
m
hardwarefailures.
h
a
r
d
w
a
r
e
f
a
i
l
u
r
e
s
.
ISO
I
S
O
26262
2
6
2
6
2
includes
i
n
c
l
u
d
e
s
guidance
g
u
i
d
a
n
c
e
to
t
o
avoid
a
v
o
i
d
these
t
h
e
s
e
risks
r
i
s
k
s
by
b
y
providing
p
r
o
v
i
d
i
n
g
appropriate
a
p
p
r
o
p
r
i
a
t
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
processes.
p
r
o
c
e
s
s
e
s
.
System
S
y
s
t
e
m
safety
s
a
f
e
t
y
is
i
s
achieved
a
c
h
i
e
v
e
d
through
t
h
r
o
u
g
h
a
a
number
n
u
m
b
e
r
of
o
f
safety
s
a
f
e
t
y
measures,
m
e
a
s
u
r
e
s
,
which
w
h
i
c
h
are
a
r
e
implemented
i
m
p
l
e
m
e
n
t
e
d
in
i
n
a
a
variety
v
a
r
i
e
t
y
of
o
f
technologies
t
e
c
h
n
o
l
o
g
i
e
s
(e.g.
(
e
.
g
.
mechanical,
m
e
c
h
a
n
i
c
a
l
,
hydraulic,
h
y
d
r
a
u
l
i
c
,
pneumatic,
p
n
e
u
m
a
t
i
c
,
electrical,
e
l
e
c
t
r
i
c
a
l
,
electronic,
e
l
e
c
t
r
o
n
i
c
,
programmable
p
r
o
g
r
a
m
m
a
b
l
e
electronic)
e
l
e
c
t
r
o
n
i
c
)
and
a
n
d
applied
a
p
p
l
i
e
d
at
a
t
the
t
h
e
various
v
a
r
i
o
u
s
levels
l
e
v
e
l
s
of
o
f
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
process.
p
r
o
c
e
s
s
.
Although
A
l
t
h
o
u
g
h
ISO
I
S
O
26262
2
6
2
6
2
is
i
s
concerned
c
o
n
c
e
r
n
e
d
with
w
i
t
h
functional
f
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
of
o
f
E/E
E
/
E
systems,
s
y
s
t
e
m
s
,
it
i
t
provides
p
r
o
v
i
d
e
s
a
a
framework
f
r
a
m
e
w
o
r
k
within
w
i
t
h
i
n
which
w
h
i
c
h
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
systems
s
y
s
t
e
m
s
based
b
a
s
e
d
on
o
n
other
o
t
h
e
r
technologies
t
e
c
h
n
o
l
o
g
i
e
s
can
c
a
n
be
b
e
considered.
c
o
n
s
i
d
e
r
e
d
.
ISO
I
S
O
26262:
2
6
2
6
2
:
-
provides
p
r
o
v
i
d
e
s
an
a
n
automotive
a
u
t
o
m
o
t
i
v
e
safety
s
a
f
e
t
y
lifecycle
l
i
f
e
c
y
c
l
e
(management,
(
m
a
n
a
g
e
m
e
n
t
,
development,
d
e
v
e
l
o
p
m
e
n
t
,
production,
p
r
o
d
u
c
t
i
o
n
,
operation,
o
p
e
r
a
t
i
o
n
,
service,
s
e
r
v
i
c
e
,
decommissioning)
d
e
c
o
m
m
i
s
s
i
o
n
i
n
g
)
and
a
n
d
supportstailoring
s
u
p
p
o
r
t
s
t
a
i
l
o
r
i
n
g
the
t
h
e
necessary
n
e
c
e
s
s
a
r
y
activities
a
c
t
i
v
i
t
i
e
s
during
d
u
r
i
n
g
these
t
h
e
s
e
lifecycle
l
i
f
e
c
y
c
l
e
phases;
p
h
a
s
e
s
;
-
provides
p
r
o
v
i
d
e
s
an
a
n
automotive-specific
a
u
t
o
m
o
t
i
v
e
-
s
p
e
c
i
f
i
c
risk-based
r
i
s
k
-
b
a
s
e
d
approach
a
p
p
r
o
a
c
h
to
t
o
determine
d
e
t
e
r
m
i
n
e
integrity
i
n
t
e
g
r
i
t
y
levels
l
e
v
e
l
s
[Automotive
[
A
u
t
o
m
o
t
i
v
e
Safety
S
a
f
e
t
y
Integrity
I
n
t
e
g
r
i
t
y
Levels
L
e
v
e
l
s
(ASIL)];
(
A
S
I
L
)
]
;
-
uses
u
s
e
s
ASILsto
A
S
I
L
s
t
o
specify
s
p
e
c
i
f
y
applicable
a
p
p
l
i
c
a
b
l
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
of
o
f
ISO
I
S
O
26262
2
6
2
6
2
so
s
o
as
a
s
to
t
o
avoid
a
v
o
i
d
unreasonable
u
n
r
e
a
s
o
n
a
b
l
e
residualrisk;
r
e
s
i
d
u
a
l
r
i
s
k
;
-
provides
p
r
o
v
i
d
e
s
requirements
r
e
q
u
i
r
e
m
e
n
t
s
for
f
o
r
validation
v
a
l
i
d
a
t
i
o
n
and
a
n
d
confirmation
c
o
n
f
i
r
m
a
t
i
o
n
measures
m
e
a
s
u
r
e
s
to
t
o
ensure
e
n
s
u
r
e
a
a
sufficient
s
u
f
f
i
c
i
e
n
t
and
a
n
d
acceptable
a
c
c
e
p
t
a
b
l
e
level
l
e
v
e
l
of
o
f
safety
s
a
f
e
t
y
being
b
e
i
n
g
achieved;
a
c
h
i
e
v
e
d
;
-
provides
p
r
o
v
i
d
e
s
requirements
r
e
q
u
i
r
e
m
e
n
t
s
for
f
o
r
relations
r
e
l
a
t
i
o
n
s
with
w
i
t
h
suppliers.
s
u
p
p
l
i
e
r
s
.
Functional
F
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
is
i
s
influenced
i
n
f
l
u
e
n
c
e
d
by
b
y
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
process
p
r
o
c
e
s
s
(including
(
i
n
c
l
u
d
i
n
g
such
s
u
c
h
activities
a
c
t
i
v
i
t
i
e
s
as
a
s
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification,
s
p
e
c
i
f
i
c
a
t
i
o
n
,
design,
d
e
s
i
g
n
,
implementation,
i
m
p
l
e
m
e
n
t
a
t
i
o
n
,
integration,
i
n
t
e
g
r
a
t
i
o
n
,
verification,
v
e
r
i
f
i
c
a
t
i
o
n
,
validation
v
a
l
i
d
a
t
i
o
n
and
a
n
d
configuration),
c
o
n
f
i
g
u
r
a
t
i
o
n
)
,
the
t
h
e
production
p
r
o
d
u
c
t
i
o
n
and
a
n
d
service
s
e
r
v
i
c
e
processes
p
r
o
c
e
s
s
e
s
and
a
n
d
by
b
y
the
t
h
e
managementprocesses.
m
a
n
a
g
e
m
e
n
t
p
r
o
c
e
s
s
e
s
.
Safety
S
a
f
e
t
y
issues
i
s
s
u
e
s
are
a
r
e
intertwined
i
n
t
e
r
t
w
i
n
e
d
with
w
i
t
h
commonfunction-oriented
c
o
m
m
o
n
f
u
n
c
t
i
o
n
-
o
r
i
e
n
t
e
d
and
a
n
d
quality-oriented
q
u
a
l
i
t
y
-
o
r
i
e
n
t
e
d
developmentactivities
d
e
v
e
l
o
p
m
e
n
t
a
c
t
i
v
i
t
i
e
s
and
a
n
d
work
w
o
r
k
products.
p
r
o
d
u
c
t
s
.
ISO
I
S
O
26262
2
6
2
6
2
addressesthe
a
d
d
r
e
s
s
e
s
t
h
e
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
aspects
a
s
p
e
c
t
s
of
o
f
developmentactivities
d
e
v
e
l
o
p
m
e
n
t
a
c
t
i
v
i
t
i
e
s
and
a
n
d
work
w
o
r
k
products.
p
r
o
d
u
c
t
s
.
Figure
F
i
g
u
r
e
1
1
showsthe
s
h
o
w
s
t
h
e
overall
o
v
e
r
a
l
l
structure
s
t
r
u
c
t
u
r
e
ofthis
o
f
t
h
i
s
edition
e
d
i
t
i
o
n
of
o
f
ISO
I
S
O
26262.
2
6
2
6
2
.
ISO
I
S
O
26262
2
6
2
6
2
is
i
s
based
b
a
s
e
d
upon
u
p
o
n
a
a
V-model
V
-
m
o
d
e
l
as
a
s
a
a
reference
r
e
f
e
r
e
n
c
e
process
p
r
o
c
e
s
s
modelfor
m
o
d
e
l
f
o
r
the
t
h
e
different
d
i
f
f
e
r
e
n
t
phases
p
h
a
s
e
s
of
o
f
product
p
r
o
d
u
c
t
development.
d
e
v
e
l
o
p
m
e
n
t
.
Within
W
i
t
h
i
n
the
t
h
e
figure:
f
i
g
u
r
e
:
—
—
the
t
h
e
shaded
s
h
a
d
e
d
“V’s
“
V
’
s
represent
r
e
p
r
e
s
e
n
t
the
t
h
e
interconnection
i
n
t
e
r
c
o
n
n
e
c
t
i
o
n
between
b
e
t
w
e
e
n
ISO
I
S
O
26262-3,
2
6
2
6
2
-
3
,
ISO
I
S
O
26262-4,
2
6
2
6
2
-
4
,
ISO
I
S
O
26262-5,
2
6
2
6
2
-
5
,
ISO
I
S
O
26262-6
2
6
2
6
2
-
6
and
a
n
d
ISO
I
S
O
26262-7;
2
6
2
6
2
-
7
;
—
—
the
t
h
e
specific
s
p
e
c
i
f
i
c
clauses
c
l
a
u
s
e
s
are
a
r
e
indicated
i
n
d
i
c
a
t
e
d
in
i
n
the
t
h
e
following
f
o
l
l
o
w
i
n
g
manner:
m
a
n
n
e
r
:
“m-n”,
“
m
-
n
”
,
where
w
h
e
r
e
“m”
“
m
”
represents
r
e
p
r
e
s
e
n
t
s
the
t
h
e
numberof
n
u
m
b
e
r
o
f
the
t
h
e
particular
p
a
r
t
i
c
u
l
a
r
part
p
a
r
t
and
a
n
d
“n”
“
n
”
indicates
i
n
d
i
c
a
t
e
s
the
t
h
e
numberof
n
u
m
b
e
r
o
f
the
t
h
e
clause
c
l
a
u
s
e
within
w
i
t
h
i
n
that
t
h
a
t
part.
p
a
r
t
.
EXAMPLE
E
X
A
M
P
L
E
“2-6”
“
2
-
6
”
represents
r
e
p
r
e
s
e
n
t
s
Clause
C
l
a
u
s
e
6
6
of
o
f
ISO
I
S
O
26262-2.
2
6
2
6
2
-
2
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
-
Vocabulary
V
o
c
a
b
u
l
a
r
y
-
Managementoffunctional
M
a
n
a
g
e
m
e
n
t
o
f
f
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
2-6
2
-
6
Safety
S
a
f
e
t
y
managementduring
m
a
n
a
g
e
m
e
n
t
d
u
r
i
n
g
the
t
h
e
concept
c
o
n
c
e
p
t
phase
p
h
a
s
e
2-7
2
-
7
Safety
S
a
f
e
t
y
management
m
a
n
a
g
e
m
e
n
t
after
a
f
t
e
r
the
t
h
e
item’s
i
t
e
m
’
s
release
r
e
l
e
a
s
e
2-5
2
-
5
Overall
O
v
e
r
a
l
l
safety
s
a
f
e
t
y
management
m
a
n
a
g
e
m
e
n
t
and
a
n
d
the
t
h
e
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
for
f
o
r
production
p
r
o
d
u
c
t
i
o
n
-
Concept
C
o
n
c
e
p
t
phase
p
h
a
s
e
peel
p
e
e
l
al
a
l
aed):
a
e
d
)
:
4.
4
.
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
are
a
r
e
tiation
t
i
a
t
i
o
n
of
o
f
product
p
r
o
d
u
c
t
4-11
4
-
1
1
Release
R
e
l
e
a
s
e
for
f
o
r
production
p
r
o
d
u
c
t
i
o
n
:
:
RSH
R
S
H
3-6Item
3
-
6
I
t
e
m
definition
d
e
f
i
n
i
t
i
o
n
pmentat
p
m
e
n
t
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
productiqg
p
r
o
d
u
c
t
i
q
g
ee
e
e
;
;
ieee
i
e
e
e
agreReE
a
g
r
e
R
e
E
af
a
f
|
|
||7-6
|
|
7
-
6
Operation,
O
p
e
r
a
t
i
o
n
,
service
s
e
r
v
i
c
e
3-6
3
-
6
Initiation
I
n
i
t
i
a
t
i
o
n
of
o
f
the
t
h
e
safety
s
a
f
e
t
y
lifecycle
l
i
f
e
c
y
c
l
e
ition
i
t
i
o
n
of
o
f
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
TEs
T
E
s
GETTER
G
E
T
T
E
R
and
a
n
d
repair),
r
e
p
a
i
r
)
,
and
a
n
d
3-7
3
-
7
Hazard
H
a
z
a
r
d
analysis
a
n
a
l
y
s
i
s
and
a
n
d
risk
r
i
s
k
1
1
ireMents
i
r
e
M
e
n
t
s
a
a
decommissioning
d
e
c
o
m
m
i
s
s
i
o
n
i
n
g
Z9Z9Z
Z
9
Z
9
Z
OSI
O
S
I
JO
J
O
MAIAIAAGC
M
A
I
A
I
A
A
G
C
—
—
|
|
ainbiy
a
i
n
b
i
y
3-8
3
-
8
Functional
F
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
Tene
T
e
n
e
ate
a
t
e
ae
a
e
concept
c
o
n
c
e
p
t
relevel
r
e
l
e
v
e
l
§
§
uct
u
c
t
ne
n
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
a
a
chitectural
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
5-8
5
-
8
Evaluation
E
v
a
l
u
a
t
i
o
n
of
o
f
the
t
h
e
Hardware
H
a
r
d
w
a
r
e
|
|
|
|
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
metrics
m
e
t
r
i
c
s
AY
A
Y
\
\
tion
t
i
o
n
e
e
5-10
5
-
1
0
Hardware
H
a
r
d
w
a
r
e
inte
i
n
t
e
testing
t
e
s
t
i
n
g
|
|
[6-11
[
6
-
1
1
Verificationofsoftware
V
e
r
i
f
i
c
a
t
i
o
n
o
f
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
8-5
8
-
5
Interfaces
I
n
t
e
r
f
a
c
e
s
within
w
i
t
h
i
n
distributed
d
i
s
t
r
i
b
u
t
e
d
developments
d
e
v
e
l
o
p
m
e
n
t
s
8-6
8
-
6
Specification
S
p
e
c
i
f
i
c
a
t
i
o
n
and
a
n
d
managementof
m
a
n
a
g
e
m
e
n
t
o
f
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
8-13
8
-
1
3
Qualification
Q
u
a
l
i
f
i
c
a
t
i
o
n
of
o
f
hardware
h
a
r
d
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
8-9
8
-
9
Verification
V
e
r
i
f
i
c
a
t
i
o
n
8-14
8
-
1
4
Proven
P
r
o
v
e
n
in
i
n
use
u
s
e
argument
a
r
g
u
m
e
n
t
9.
9
.
ASIL-oriented
A
S
I
L
-
o
r
i
e
n
t
e
d
and
a
n
d
safety-oriented
s
a
f
e
t
y
-
o
r
i
e
n
t
e
d
analyses
a
n
a
l
y
s
e
s
9-5
9
-
5
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
decomposition
d
e
c
o
m
p
o
s
i
t
i
o
n
with
w
i
t
h
respect
r
e
s
p
e
c
t
to
t
o
ASIL
A
S
I
L
tailoring
t
a
i
l
o
r
i
n
g
9-7
9
-
7
Analysis
A
n
a
l
y
s
i
s
of
o
f
dependent
d
e
p
e
n
d
e
n
t
failures
f
a
i
l
u
r
e
s
9-6
9
-
6
Criteria
C
r
i
t
e
r
i
a
for
f
o
r
coexistence
c
o
e
x
i
s
t
e
n
c
e
of
o
f
elements
e
l
e
m
e
n
t
s
9-8
9
-
8
Safety
S
a
f
e
t
y
analyses
a
n
a
l
y
s
e
s
10.
1
0
.
Guideline
G
u
i
d
e
l
i
n
e
on
o
n
ISO
I
S
O
26262
2
6
2
6
2
(3)LL0z:9-z9z9z
(
3
)
L
L
0
z
:
9
-
z
9
z
9
z
OSI
O
S
I
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
INTERNATIONAL
I
N
T
E
R
N
A
T
I
O
N
A
L
STANDARD
S
T
A
N
D
A
R
D
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
—
—
Part
P
a
r
t
6:
6
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
softwarelevel
s
o
f
t
w
a
r
e
l
e
v
e
l
1
1
Scope
S
c
o
p
e
ISO
I
S
O
26262
2
6
2
6
2
is
i
s
intended
i
n
t
e
n
d
e
d
to
t
o
be
b
e
applied
a
p
p
l
i
e
d
to
t
o
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
systems
s
y
s
t
e
m
s
that
t
h
a
t
include
i
n
c
l
u
d
e
one
o
n
e
or
o
r
more
m
o
r
e
electrical
e
l
e
c
t
r
i
c
a
l
and/or
a
n
d
/
o
r
electronic
e
l
e
c
t
r
o
n
i
c
(E/E)
(
E
/
E
)
systems
s
y
s
t
e
m
s
andthat
a
n
d
t
h
a
t
are
a
r
e
installed
i
n
s
t
a
l
l
e
d
in
i
n
series
s
e
r
i
e
s
production
p
r
o
d
u
c
t
i
o
n
passenger
p
a
s
s
e
n
g
e
r
cars
c
a
r
s
with
w
i
t
h
a
a
maximum
m
a
x
i
m
u
m
gross
g
r
o
s
s
vehicle
v
e
h
i
c
l
e
mass
m
a
s
s
up
u
p
to
t
o
3
3
500
5
0
0
kg.
k
g
.
ISO
I
S
O
26262
2
6
2
6
2
does
d
o
e
s
not
n
o
t
address
a
d
d
r
e
s
s
unique
u
n
i
q
u
e
E/E
E
/
E
systems
s
y
s
t
e
m
s
in
i
n
special
s
p
e
c
i
a
l
purpose
p
u
r
p
o
s
e
vehicles
v
e
h
i
c
l
e
s
such
s
u
c
h
asvehicles
a
s
v
e
h
i
c
l
e
s
designedfor
d
e
s
i
g
n
e
d
f
o
r
drivers
d
r
i
v
e
r
s
with
w
i
t
h
disabilities.
d
i
s
a
b
i
l
i
t
i
e
s
.
Systems
S
y
s
t
e
m
s
and
a
n
d
their
t
h
e
i
r
components
c
o
m
p
o
n
e
n
t
s
released
r
e
l
e
a
s
e
d
for
f
o
r
production,
p
r
o
d
u
c
t
i
o
n
,
or
o
r
systems
s
y
s
t
e
m
s
and
a
n
d
their
t
h
e
i
r
components
c
o
m
p
o
n
e
n
t
s
already
a
l
r
e
a
d
y
under
u
n
d
e
r
development
d
e
v
e
l
o
p
m
e
n
t
prior
p
r
i
o
r
to
t
o
the
t
h
e
publication
p
u
b
l
i
c
a
t
i
o
n
date
d
a
t
e
of
o
f
ISO
I
S
O
26262,
2
6
2
6
2
,
are
a
r
e
exempted
e
x
e
m
p
t
e
d
from
f
r
o
m
the
t
h
e
scope.
s
c
o
p
e
.
For
F
o
r
further
f
u
r
t
h
e
r
development
d
e
v
e
l
o
p
m
e
n
t
oralterations
o
r
a
l
t
e
r
a
t
i
o
n
s
based
b
a
s
e
d
on
o
n
systems
s
y
s
t
e
m
s
and
a
n
d
their
t
h
e
i
r
components
c
o
m
p
o
n
e
n
t
s
released
r
e
l
e
a
s
e
d
for
f
o
r
production
p
r
o
d
u
c
t
i
o
n
prior
p
r
i
o
r
to
t
o
the
t
h
e
publication
p
u
b
l
i
c
a
t
i
o
n
of
o
f
ISO
I
S
O
26262,
2
6
2
6
2
,
only
o
n
l
y
the
t
h
e
modifications
m
o
d
i
f
i
c
a
t
i
o
n
s
will
w
i
l
l
be
b
e
developed
d
e
v
e
l
o
p
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262.
2
6
2
6
2
.
ISO
I
S
O
26262
2
6
2
6
2
addresses
a
d
d
r
e
s
s
e
s
possible
p
o
s
s
i
b
l
e
hazards
h
a
z
a
r
d
s
caused
c
a
u
s
e
d
,by
,
b
y
malfunctioning
m
a
l
f
u
n
c
t
i
o
n
i
n
g
behaviour
b
e
h
a
v
i
o
u
r
of
o
f
E/E
E
/
E
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
systems,
s
y
s
t
e
m
s
,
including
i
n
c
l
u
d
i
n
g
interaction
i
n
t
e
r
a
c
t
i
o
n
of
o
f
these
t
h
e
s
e
systems.It
s
y
s
t
e
m
s
.
I
t
does
d
o
e
s
not
n
o
t
address
a
d
d
r
e
s
s
hazardsrelatedto
h
a
z
a
r
d
s
r
e
l
a
t
e
d
t
o
electric
e
l
e
c
t
r
i
c
shock,
s
h
o
c
k
,
fire,
f
i
r
e
,
smoke,
s
m
o
k
e
,
heat,
h
e
a
t
,
radiation,
r
a
d
i
a
t
i
o
n
,
toxicity,
t
o
x
i
c
i
t
y
,
flammability,
f
l
a
m
m
a
b
i
l
i
t
y
,
reactivity,
r
e
a
c
t
i
v
i
t
y
,
corrosion,
c
o
r
r
o
s
i
o
n
,
release
r
e
l
e
a
s
e
of
o
f
energy
e
n
e
r
g
y
and
a
n
d
similar
s
i
m
i
l
a
r
hazards,
h
a
z
a
r
d
s
,
unless
u
n
l
e
s
s
directly
d
i
r
e
c
t
l
y
caused
c
a
u
s
e
d
by
b
y
malfunctioning
m
a
l
f
u
n
c
t
i
o
n
i
n
g
behaviour
b
e
h
a
v
i
o
u
r
of
o
f
E/E
E
/
E
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
systems.
s
y
s
t
e
m
s
.
ISO
I
S
O
26262
2
6
2
6
2
does
d
o
e
s
not
n
o
t
address
a
d
d
r
e
s
s
the
t
h
e
nominal
n
o
m
i
n
a
l
performance
p
e
r
f
o
r
m
a
n
c
e
of
o
f
E/E
E
/
E
systems,
s
y
s
t
e
m
s
,
even
e
v
e
n
if
i
f
dedicated
d
e
d
i
c
a
t
e
d
functional
f
u
n
c
t
i
o
n
a
l
performance
p
e
r
f
o
r
m
a
n
c
e
standards
s
t
a
n
d
a
r
d
s
exist
e
x
i
s
t
for
f
o
r
these
t
h
e
s
e
systems
s
y
s
t
e
m
s
(e.g.
(
e
.
g
.
active
a
c
t
i
v
e
and
a
n
d
passive
p
a
s
s
i
v
e
safety
s
a
f
e
t
y
systems,
s
y
s
t
e
m
s
,
brake
b
r
a
k
e
systems,
s
y
s
t
e
m
s
,
Adaptive
A
d
a
p
t
i
v
e
Cruise
C
r
u
i
s
e
Control).
C
o
n
t
r
o
l
)
.
This
T
h
i
s
part
p
a
r
t
of
o
f
ISO
I
S
O
26262
2
6
2
6
2
specifies
s
p
e
c
i
f
i
e
s
the
t
h
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
for
f
o
r
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
for
f
o
r
automotive
a
u
t
o
m
o
t
i
v
e
applications,
a
p
p
l
i
c
a
t
i
o
n
s
,
including
i
n
c
l
u
d
i
n
g
the
t
h
e
following:
f
o
l
l
o
w
i
n
g
:
—
—
requirementsforinitiation
r
e
q
u
i
r
e
m
e
n
t
s
f
o
r
i
n
i
t
i
a
t
i
o
n
of
o
f
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
softwarelevel,
s
o
f
t
w
a
r
e
l
e
v
e
l
,
—
—
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
—
—
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design,
d
e
s
i
g
n
,
—
—
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation,
i
m
p
l
e
m
e
n
t
a
t
i
o
n
,
—
—
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing,
t
e
s
t
i
n
g
,
—
—
softwareintegration
s
o
f
t
w
a
r
e
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing,
t
e
s
t
i
n
g
,
and
a
n
d
—
—
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
2
2
Normative
N
o
r
m
a
t
i
v
e
references
r
e
f
e
r
e
n
c
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
referenced
r
e
f
e
r
e
n
c
e
d
documents
d
o
c
u
m
e
n
t
s
are
a
r
e
indispensable
i
n
d
i
s
p
e
n
s
a
b
l
e
for
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
this
t
h
i
s
document.
d
o
c
u
m
e
n
t
.
For
F
o
r
dated
d
a
t
e
d
references,
r
e
f
e
r
e
n
c
e
s
,
only
o
n
l
y
the
t
h
e
edition
e
d
i
t
i
o
n
cited
c
i
t
e
d
applies.
a
p
p
l
i
e
s
.
For
F
o
r
undated
u
n
d
a
t
e
d
references,
r
e
f
e
r
e
n
c
e
s
,
the
t
h
e
latest
l
a
t
e
s
t
edition
e
d
i
t
i
o
n
of
o
f
the
t
h
e
referenced
r
e
f
e
r
e
n
c
e
d
document(including
d
o
c
u
m
e
n
t
(
i
n
c
l
u
d
i
n
g
any
a
n
y
amendments)
a
m
e
n
d
m
e
n
t
s
)
applies.
a
p
p
l
i
e
s
.
ISO
I
S
O
26262-1:2011,
2
6
2
6
2
-
1
:
2
0
1
1
,
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety—
s
a
f
e
t
y
—
Part
P
a
r
t
1:
1
:
Vocabulary
V
o
c
a
b
u
l
a
r
y
ISO
I
S
O
26262-2:2011,
2
6
2
6
2
-
2
:
2
0
1
1
,
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety—
s
a
f
e
t
y
—
Part
P
a
r
t
2:
2
:
Managementof
M
a
n
a
g
e
m
e
n
t
o
f
functional
f
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety—
s
a
f
e
t
y
—
Part
P
a
r
t
4:
4
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
ISO
I
S
O
26262-5:2011,
2
6
2
6
2
-
5
:
2
0
1
1
,
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety—
s
a
f
e
t
y
—
Part
P
a
r
t
5:
5
:
Product
P
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
hardware
h
a
r
d
w
a
r
e
level
l
e
v
e
l
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety—
s
a
f
e
t
y
—
Part
P
a
r
t
8:
8
:
Supporting
S
u
p
p
o
r
t
i
n
g
processes
p
r
o
c
e
s
s
e
s
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Road
R
o
a
d
vehicles
v
e
h
i
c
l
e
s
—
—
Functional
F
u
n
c
t
i
o
n
a
l
safety—
s
a
f
e
t
y
—
Part
P
a
r
t
9:
9
:
Automotive
A
u
t
o
m
o
t
i
v
e
Safety
S
a
f
e
t
y
Integrity
I
n
t
e
g
r
i
t
y
Level
L
e
v
e
l
(ASIL)-
(
A
S
I
L
)
-
oriented
o
r
i
e
n
t
e
d
and
a
n
d
safety-oriented
s
a
f
e
t
y
-
o
r
i
e
n
t
e
d
analyses
a
n
a
l
y
s
e
s
3
3
Terms,definitions
T
e
r
m
s
,
d
e
f
i
n
i
t
i
o
n
s
and
a
n
d
abbreviated
a
b
b
r
e
v
i
a
t
e
d
terms
t
e
r
m
s
For
F
o
r
the
t
h
e
purposes
p
u
r
p
o
s
e
s
of
o
f
this
t
h
i
s
document,
d
o
c
u
m
e
n
t
,
the
t
h
e
terms,
t
e
r
m
s
,
definitions
d
e
f
i
n
i
t
i
o
n
s
and
a
n
d
abbreviated
a
b
b
r
e
v
i
a
t
e
d
terms
t
e
r
m
s
given
g
i
v
e
n
in
i
n
ISO
I
S
O
26262-1:2011
2
6
2
6
2
-
1
:
2
0
1
1
apply.
a
p
p
l
y
.
4
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
for
f
o
r
compliance
c
o
m
p
l
i
a
n
c
e
4.1
4
.
1
General
G
e
n
e
r
a
l
requirements
r
e
q
u
i
r
e
m
e
n
t
s
When
W
h
e
n
claiming
c
l
a
i
m
i
n
g
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262,
2
6
2
6
2
,
each
e
a
c
h
requirement
r
e
q
u
i
r
e
m
e
n
t
shall
s
h
a
l
l
be
b
e
complied
c
o
m
p
l
i
e
d
with,
w
i
t
h
,
unless
u
n
l
e
s
s
one
o
n
e
of
o
f
the
t
h
e
following
f
o
l
l
o
w
i
n
g
applies:
a
p
p
l
i
e
s
:
-
tailoring
t
a
i
l
o
r
i
n
g
of
o
f
the
t
h
e
safety
s
a
f
e
t
y
activities
a
c
t
i
v
i
t
i
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-2
2
6
2
6
2
-
2
has
h
a
s
been
b
e
e
n
planned
p
l
a
n
n
e
d
and
a
n
d
showsthat
s
h
o
w
s
t
h
a
t
the
t
h
e
requirement
r
e
q
u
i
r
e
m
e
n
t
does
d
o
e
s
not
n
o
t
apply,
a
p
p
l
y
,
or
o
r
-
a
a
rationale
r
a
t
i
o
n
a
l
e
is
i
s
available
a
v
a
i
l
a
b
l
e
that
t
h
a
t
the
t
h
e
non-compliance
n
o
n
-
c
o
m
p
l
i
a
n
c
e
is
i
s
acceptable
a
c
c
e
p
t
a
b
l
e
and
a
n
d
the
t
h
e
rationale
r
a
t
i
o
n
a
l
e
has
h
a
s
been
b
e
e
n
assessed
a
s
s
e
s
s
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-2.
2
6
2
6
2
-
2
.
;
;
Information
I
n
f
o
r
m
a
t
i
o
n
marked
m
a
r
k
e
d
as
a
s
a
a
“NOTE”
“
N
O
T
E
”
or
o
r
“EXAMPLE”is
“
E
X
A
M
P
L
E
”
i
s
only
o
n
l
y
for
f
o
r
guidance
g
u
i
d
a
n
c
e
in
i
n
understanding,or
u
n
d
e
r
s
t
a
n
d
i
n
g
,
o
r
forclarification
f
o
r
c
l
a
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
associated
a
s
s
o
c
i
a
t
e
d
requirement,
r
e
q
u
i
r
e
m
e
n
t
,
and
a
n
d
shall
s
h
a
l
l
not
n
o
t
be
b
e
interpreted
i
n
t
e
r
p
r
e
t
e
d
as
a
s
a
a
requirementitself
r
e
q
u
i
r
e
m
e
n
t
i
t
s
e
l
f
or
o
r
as
a
s
complete
c
o
m
p
l
e
t
e
or
o
r
exhaustive.
e
x
h
a
u
s
t
i
v
e
.
The
T
h
e
results
r
e
s
u
l
t
s
of
o
f
safety
s
a
f
e
t
y
activities
a
c
t
i
v
i
t
i
e
s
are
a
r
e
given
g
i
v
e
n
as
a
s
work
w
o
r
k
products.
p
r
o
d
u
c
t
s
.
“Prerequisites”
“
P
r
e
r
e
q
u
i
s
i
t
e
s
”
are
a
r
e
information
i
n
f
o
r
m
a
t
i
o
n
which
w
h
i
c
h
shall
s
h
a
l
l
be
b
e
available
a
v
a
i
l
a
b
l
e
as
a
s
work
w
o
r
k
products
p
r
o
d
u
c
t
s
of
o
f
a
a
previous
p
r
e
v
i
o
u
s
phase.
p
h
a
s
e
.
Given
G
i
v
e
n
that
t
h
a
t
certain
c
e
r
t
a
i
n
requirements
r
e
q
u
i
r
e
m
e
n
t
s
of
o
f
a
a
clause
c
l
a
u
s
e
are
a
r
e
ASIL-dependent
A
S
I
L
-
d
e
p
e
n
d
e
n
t
or
o
r
maybetailored,
m
a
y
b
e
t
a
i
l
o
r
e
d
,
certain
c
e
r
t
a
i
n
work
w
o
r
k
products
p
r
o
d
u
c
t
s
may
m
a
y
not
n
o
t
be
b
e
needed
n
e
e
d
e
d
as
a
s
prerequisites.
p
r
e
r
e
q
u
i
s
i
t
e
s
.
“Further
“
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information”is
i
n
f
o
r
m
a
t
i
o
n
”
i
s
information
i
n
f
o
r
m
a
t
i
o
n
that
t
h
a
t
can
c
a
n
be
b
e
considered,
c
o
n
s
i
d
e
r
e
d
,
but
b
u
t
which
w
h
i
c
h
in
i
n
some
s
o
m
e
casesis
c
a
s
e
s
i
s
not
n
o
t
required
r
e
q
u
i
r
e
d
by
b
y
ISO
I
S
O
26262
2
6
2
6
2
as
a
s
a
a
work
w
o
r
k
product
p
r
o
d
u
c
t
of
o
f
a
a
previous
p
r
e
v
i
o
u
s
phase
p
h
a
s
e
and
a
n
d
which
w
h
i
c
h
may
m
a
y
be
b
e
madeavailable
m
a
d
e
a
v
a
i
l
a
b
l
e
by
b
y
external
e
x
t
e
r
n
a
l
sources
s
o
u
r
c
e
s
that
t
h
a
t
are
a
r
e
different
d
i
f
f
e
r
e
n
t
from
f
r
o
m
the
t
h
e
personsor
p
e
r
s
o
n
s
o
r
organizations
o
r
g
a
n
i
z
a
t
i
o
n
s
responsible
r
e
s
p
o
n
s
i
b
l
e
for
f
o
r
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
activities.
a
c
t
i
v
i
t
i
e
s
.
4.2
4
.
2
Interpretations
I
n
t
e
r
p
r
e
t
a
t
i
o
n
s
of
o
f
tables
t
a
b
l
e
s
Tables
T
a
b
l
e
s
are
a
r
e
normative
n
o
r
m
a
t
i
v
e
or
o
r
informative
i
n
f
o
r
m
a
t
i
v
e
depending
d
e
p
e
n
d
i
n
g
on
o
n
their
t
h
e
i
r
context.
c
o
n
t
e
x
t
.
The
T
h
e
different
d
i
f
f
e
r
e
n
t
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
a
a
table
t
a
b
l
e
contribute
c
o
n
t
r
i
b
u
t
e
to
t
o
the
t
h
e
level
l
e
v
e
l
of
o
f
confidence
c
o
n
f
i
d
e
n
c
e
in
i
n
achieving
a
c
h
i
e
v
i
n
g
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
requirement.
r
e
q
u
i
r
e
m
e
n
t
.
Each
E
a
c
h
methodin
m
e
t
h
o
d
i
n
a
a
table
t
a
b
l
e
is
i
s
either
e
i
t
h
e
r
-
aconsecutive
a
c
o
n
s
e
c
u
t
i
v
e
entry
e
n
t
r
y
(marked
(
m
a
r
k
e
d
by
b
y
a
a
sequence
s
e
q
u
e
n
c
e
numberin
n
u
m
b
e
r
i
n
the
t
h
e
leftmost
l
e
f
t
m
o
s
t
column,
c
o
l
u
m
n
,
e.g.
e
.
g
.
1,
1
,
2,
2
,
3),
3
)
,
or
o
r
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
-
an
a
n
alternative
a
l
t
e
r
n
a
t
i
v
e
entry
e
n
t
r
y
(marked
(
m
a
r
k
e
d
by
b
y
a
a
numberfollowedbya
n
u
m
b
e
r
f
o
l
l
o
w
e
d
b
y
a
letter
l
e
t
t
e
r
in
i
n
the
t
h
e
leftmost
l
e
f
t
m
o
s
t
column,
c
o
l
u
m
n
,
e.g.
e
.
g
.
2a,
2
a
,
2b,
2
b
,
2c).
2
c
)
.
For
F
o
r
consecutive
c
o
n
s
e
c
u
t
i
v
e
entries,
e
n
t
r
i
e
s
,
all
a
l
l
methods
m
e
t
h
o
d
s
shall
s
h
a
l
l
be
b
e
applied
a
p
p
l
i
e
d
as
a
s
recommended
r
e
c
o
m
m
e
n
d
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
ASIL.If
A
S
I
L
.
I
f
methodsother
m
e
t
h
o
d
s
o
t
h
e
r
than
t
h
a
n
thoselisted
t
h
o
s
e
l
i
s
t
e
d
are
a
r
e
to
t
o
be
b
e
applied,
a
p
p
l
i
e
d
,
a
a
rationale
r
a
t
i
o
n
a
l
e
shall
s
h
a
l
l
be
b
e
given
g
i
v
e
n
that
t
h
a
t
these
t
h
e
s
e
fulfil
f
u
l
f
i
l
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
requirement.
r
e
q
u
i
r
e
m
e
n
t
.
For
F
o
r
alternative
a
l
t
e
r
n
a
t
i
v
e
entries,
e
n
t
r
i
e
s
,
an
a
n
appropriate
a
p
p
r
o
p
r
i
a
t
e
combination
c
o
m
b
i
n
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
shall
s
h
a
l
l
be
b
e
applied
a
p
p
l
i
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
ASIL
A
S
I
L
indicated,
i
n
d
i
c
a
t
e
d
,
independent
i
n
d
e
p
e
n
d
e
n
t
of
o
f
whether
w
h
e
t
h
e
r
they
t
h
e
y
are
a
r
e
listed
l
i
s
t
e
d
in
i
n
the
t
h
e
table
t
a
b
l
e
or
o
r
not.
n
o
t
.
If
I
f
methods
m
e
t
h
o
d
s
are
a
r
e
listed
l
i
s
t
e
d
with
w
i
t
h
different
d
i
f
f
e
r
e
n
t
degrees
d
e
g
r
e
e
s
of
o
f
recommendation
r
e
c
o
m
m
e
n
d
a
t
i
o
n
for
f
o
r
an
a
n
ASIL,
A
S
I
L
,
the
t
h
e
methods
m
e
t
h
o
d
s
with
w
i
t
h
the
t
h
e
higher
h
i
g
h
e
r
recommendation
r
e
c
o
m
m
e
n
d
a
t
i
o
n
should
s
h
o
u
l
d
be
b
e
preferred.
p
r
e
f
e
r
r
e
d
.
A
A
rationale
r
a
t
i
o
n
a
l
e
shall
s
h
a
l
l
be
b
e
given
g
i
v
e
n
that
t
h
a
t
the
t
h
e
selected
s
e
l
e
c
t
e
d
combination
c
o
m
b
i
n
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
complies
c
o
m
p
l
i
e
s
with
w
i
t
h
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
requirement.
r
e
q
u
i
r
e
m
e
n
t
.
NOTE
N
O
T
E
A
A
rationale
r
a
t
i
o
n
a
l
e
based
b
a
s
e
d
on
o
n
the
t
h
e
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
the
t
h
e
table
t
a
b
l
e
is
i
s
sufficient.
s
u
f
f
i
c
i
e
n
t
.
However,
H
o
w
e
v
e
r
,
this
t
h
i
s
does
d
o
e
s
not
n
o
t
imply
i
m
p
l
y
a
a
bias
b
i
a
s
for
f
o
r
or
o
r
against
a
g
a
i
n
s
t
methodsnotlisted
m
e
t
h
o
d
s
n
o
t
l
i
s
t
e
d
in
i
n
the
t
h
e
table.
t
a
b
l
e
.
For
F
o
r
each
e
a
c
h
method,
m
e
t
h
o
d
,
the
t
h
e
degree
d
e
g
r
e
e
of
o
f
recommendation
r
e
c
o
m
m
e
n
d
a
t
i
o
n
to
t
o
use
u
s
e
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
method
m
e
t
h
o
d
dependson
d
e
p
e
n
d
s
o
n
the
t
h
e
ASIL
A
S
I
L
and
a
n
d
is
i
s
categorized
c
a
t
e
g
o
r
i
z
e
d
as
a
s
follows:
f
o
l
l
o
w
s
:
“++”
“
+
+
”
indicates
i
n
d
i
c
a
t
e
s
that
t
h
a
t
the
t
h
e
method
m
e
t
h
o
d
is
i
s
highly
h
i
g
h
l
y
recommendedforthe
r
e
c
o
m
m
e
n
d
e
d
f
o
r
t
h
e
identified
i
d
e
n
t
i
f
i
e
d
ASIL;
A
S
I
L
;
—
—
“+”
“
+
”
indicates
i
n
d
i
c
a
t
e
s
that
t
h
a
t
the
t
h
e
method
m
e
t
h
o
d
is
i
s
recommendedforthe
r
e
c
o
m
m
e
n
d
e
d
f
o
r
t
h
e
identified
i
d
e
n
t
i
f
i
e
d
ASIL;
A
S
I
L
;
roe
r
o
e
—
—
“o”
“
o
”
indicates
i
n
d
i
c
a
t
e
s
that
t
h
a
t
the
t
h
e
method
m
e
t
h
o
d
has
h
a
s
no
n
o
recommendation
r
e
c
o
m
m
e
n
d
a
t
i
o
n
for
f
o
r
or
o
r
against
a
g
a
i
n
s
t
its
i
t
s
usage
u
s
a
g
e
for
f
o
r
the
t
h
e
identified
i
d
e
n
t
i
f
i
e
d
ASIL.
A
S
I
L
.
4.3
4
.
3
ASIL-dependent
A
S
I
L
-
d
e
p
e
n
d
e
n
t
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
The
T
h
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
or
o
r
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
of
o
f
each
e
a
c
h
subclause
s
u
b
c
l
a
u
s
e
shall
s
h
a
l
l
be
b
e
complied
c
o
m
p
l
i
e
d
with
w
i
t
h
for
f
o
r
ASIL
A
S
I
L
A,
A
,
B,
B
,
C
C
and
a
n
d
D,
D
,
if
i
f
not
n
o
t
stated
s
t
a
t
e
d
otherwise.
o
t
h
e
r
w
i
s
e
.
These
T
h
e
s
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
refer
r
e
f
e
r
to
t
o
the
t
h
e
ASIL
A
S
I
L
of
o
f
the
t
h
e
safety
s
a
f
e
t
y
goal.
g
o
a
l
.
If
I
f
ASIL
A
S
I
L
decomposition
d
e
c
o
m
p
o
s
i
t
i
o
n
has
h
a
s
been
b
e
e
n
performed
p
e
r
f
o
r
m
e
d
at
a
t
an
a
n
earlier
e
a
r
l
i
e
r
stage
s
t
a
g
e
of
o
f
development,
d
e
v
e
l
o
p
m
e
n
t
,
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Clause
C
l
a
u
s
e
5,
5
,
the
t
h
e
ASIL
A
S
I
L
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
the
t
h
e
decomposition
d
e
c
o
m
p
o
s
i
t
i
o
n
shall
s
h
a
l
l
be
b
e
complied
c
o
m
p
l
i
e
d
with.
w
i
t
h
.
If
I
f
an
a
n
ASIL
A
S
I
L
is
i
s
given
g
i
v
e
n
in
i
n
parentheses
p
a
r
e
n
t
h
e
s
e
s
in
i
n
ISO
I
S
O
26262,
2
6
2
6
2
,
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
subclause
s
u
b
c
l
a
u
s
e
shall
s
h
a
l
l
be
b
e
considered
c
o
n
s
i
d
e
r
e
d
as
a
s
a
a
recommendation
r
e
c
o
m
m
e
n
d
a
t
i
o
n
rather
r
a
t
h
e
r
than
t
h
a
n
a
a
requirementfor
r
e
q
u
i
r
e
m
e
n
t
f
o
r
this
t
h
i
s
ASIL.
A
S
I
L
.
This
T
h
i
s
has
h
a
s
no
n
o
link
l
i
n
k
with
w
i
t
h
the
t
h
e
parenthesis
p
a
r
e
n
t
h
e
s
i
s
notation
n
o
t
a
t
i
o
n
related
r
e
l
a
t
e
d
to
t
o
ASIL
A
S
I
L
decomposition.
d
e
c
o
m
p
o
s
i
t
i
o
n
.
5
5
Initiation
I
n
i
t
i
a
t
i
o
n
of
o
f
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
softwarelevel
s
o
f
t
w
a
r
e
l
e
v
e
l
5.1
5
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phaseis
s
u
b
-
p
h
a
s
e
i
s
to
t
o
plan
p
l
a
n
andinitiate
a
n
d
i
n
i
t
i
a
t
e
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
activities
a
c
t
i
v
i
t
i
e
s
for
f
o
r
the
t
h
e
sub-phases
s
u
b
-
p
h
a
s
e
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
development.
d
e
v
e
l
o
p
m
e
n
t
.
5.2
5
.
2
General
G
e
n
e
r
a
l
Theinitiation
T
h
e
i
n
i
t
i
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
developmentis
d
e
v
e
l
o
p
m
e
n
t
i
s
a
a
planning
p
l
a
n
n
i
n
g
activity,
a
c
t
i
v
i
t
y
,
where
w
h
e
r
e
software
s
o
f
t
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
sub-phases
s
u
b
-
p
h
a
s
e
s
and
a
n
d
their
t
h
e
i
r
supporting
s
u
p
p
o
r
t
i
n
g
processes
p
r
o
c
e
s
s
e
s
(see
(
s
e
e
ISO
I
S
O
26262-8
2
6
2
6
2
-
8
and
a
n
d
ISO
I
S
O
26262-9)
2
6
2
6
2
-
9
)
are
a
r
e
determined
d
e
t
e
r
m
i
n
e
d
and
a
n
d
planned
p
l
a
n
n
e
d
according
a
c
c
o
r
d
i
n
g
to
t
o
the
t
h
e
extent
e
x
t
e
n
t
and
a
n
d
complexity
c
o
m
p
l
e
x
i
t
y
of
o
f
the
t
h
e
item
i
t
e
m
development.
d
e
v
e
l
o
p
m
e
n
t
.
The
T
h
e
software
s
o
f
t
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
sub-phases
s
u
b
-
p
h
a
s
e
s
and
a
n
d
supporting
s
u
p
p
o
r
t
i
n
g
processesareinitiated
p
r
o
c
e
s
s
e
s
a
r
e
i
n
i
t
i
a
t
e
d
by
b
y
determining
d
e
t
e
r
m
i
n
i
n
g
the
t
h
e
appropriate
a
p
p
r
o
p
r
i
a
t
e
methods
m
e
t
h
o
d
s
in
i
n
order
o
r
d
e
r
to
t
o
comply
c
o
m
p
l
y
with
w
i
t
h
the
t
h
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
their
t
h
e
i
r
respective
r
e
s
p
e
c
t
i
v
e
ASIL.
A
S
I
L
.
The
T
h
e
methods
m
e
t
h
o
d
s
are
a
r
e
supported
s
u
p
p
o
r
t
e
d
by
b
y
guidelines
g
u
i
d
e
l
i
n
e
s
and
a
n
d
tools,
t
o
o
l
s
,
which
w
h
i
c
h
are
a
r
e
determined
d
e
t
e
r
m
i
n
e
d
and
a
n
d
planned
p
l
a
n
n
e
d
for
f
o
r
each
e
a
c
h
sub-phase
s
u
b
-
p
h
a
s
e
and
a
n
d
supporting
s
u
p
p
o
r
t
i
n
g
process.
p
r
o
c
e
s
s
.
NOTE
N
O
T
E
Tools
T
o
o
l
s
used
u
s
e
d
for
f
o
r
software
s
o
f
t
w
a
r
e
developmentcan
d
e
v
e
l
o
p
m
e
n
t
c
a
n
include
i
n
c
l
u
d
e
tools
t
o
o
l
s
other
o
t
h
e
r
than
t
h
a
n
softwaretools.
s
o
f
t
w
a
r
e
t
o
o
l
s
.
EXAMPLE
E
X
A
M
P
L
E
Tools
T
o
o
l
s
used
u
s
e
d
for
f
o
r
testing
t
e
s
t
i
n
g
phases.
p
h
a
s
e
s
.
The
T
h
e
planning
p
l
a
n
n
i
n
g
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
includes
i
n
c
l
u
d
e
s
the
t
h
e
coordination
c
o
o
r
d
i
n
a
t
i
o
n
with
w
i
t
h
the
t
h
e
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
(see
(
s
e
e
ISO
I
S
O
26262-4)
2
6
2
6
2
-
4
)
and
a
n
d
the
t
h
e
hardwarelevel
h
a
r
d
w
a
r
e
l
e
v
e
l
(see
(
s
e
e
ISO
I
S
O
26262-5).
2
6
2
6
2
-
5
)
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
5.3
5
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
5.3.1
5
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
projectplan
p
r
o
j
e
c
t
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
5.5.1:
5
.
5
.
1
:
—
—
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:201
2
6
2
6
2
-
4
:
2
0
1
A
A
52522)
5
2
5
2
2
)
—_
—
_
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.1:
7
.
5
.
1
:
—
—
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.2;
7
.
5
.
2
;
and
a
n
d
—
—
item
i
t
e
m
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing
t
e
s
t
i
n
g
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
8.5.1.
8
.
5
.
1
.
5.3.2
5
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
qualified
q
u
a
l
i
f
i
e
d
software
s
o
f
t
w
a
r
e
tools
t
o
o
l
s
available
a
v
a
i
l
a
b
l
e
(see
(
s
e
e
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
11);
1
1
)
;
—
—
qualified
q
u
a
l
i
f
i
e
d
software
s
o
f
t
w
a
r
e
componentsavailable
c
o
m
p
o
n
e
n
t
s
a
v
a
i
l
a
b
l
e
(see
(
s
e
e
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
12):
1
2
)
:
—
—
design
d
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
languages(from
l
a
n
g
u
a
g
e
s
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source);
s
o
u
r
c
e
)
;
—
—
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source);
s
o
u
r
c
e
)
;
and
a
n
d
—
—
guidelinesfor
g
u
i
d
e
l
i
n
e
s
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
tools
t
o
o
l
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
5.4
5
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
5.4.1.
5
.
4
.
1
.
The
T
h
e
activities
a
c
t
i
v
i
t
i
e
s
and
a
n
d
the
t
h
e
determination
d
e
t
e
r
m
i
n
a
t
i
o
n
of
o
f
appropriate
a
p
p
r
o
p
r
i
a
t
e
methods
m
e
t
h
o
d
s
for
f
o
r
the
t
h
e
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
shall
s
h
a
l
l
be
b
e
planned.
p
l
a
n
n
e
d
.
5.4.2
5
.
4
.
2
The
T
h
e
tailoring
t
a
i
l
o
r
i
n
g
of
o
f
the
t
h
e
lifecycle
l
i
f
e
c
y
c
l
e
for
f
o
r
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
shall
s
h
a
l
l
be
b
e
performed
p
e
r
f
o
r
m
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-2:2011,
2
6
2
6
2
-
2
:
2
0
1
1
,
6.4.5,
6
.
4
.
5
,
and
a
n
d
based
b
a
s
e
d
on
o
n
the
t
h
e
reference
r
e
f
e
r
e
n
c
e
phase
p
h
a
s
e
modelgivenin
m
o
d
e
l
g
i
v
e
n
i
n
Figure
F
i
g
u
r
e
2.
2
.
5.4.3
5
.
4
.
3
If
I
f
developing
d
e
v
e
l
o
p
i
n
g
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software,
s
o
f
t
w
a
r
e
,
Annex
A
n
n
e
x
C
C
shall
s
h
a
l
l
be
b
e
applied.
a
p
p
l
i
e
d
.
5.4.4
5
.
4
.
4
The
T
h
e
software
s
o
f
t
w
a
r
e
developmentprocessfor
d
e
v
e
l
o
p
m
e
n
t
p
r
o
c
e
s
s
f
o
r
the
t
h
e
software
s
o
f
t
w
a
r
e
of
o
f
an
a
n
item,
i
t
e
m
,
including
i
n
c
l
u
d
i
n
g
lifecycle
l
i
f
e
c
y
c
l
e
phases,
p
h
a
s
e
s
,
methods,
m
e
t
h
o
d
s
,
languagesandtools,
l
a
n
g
u
a
g
e
s
a
n
d
t
o
o
l
s
,
shall
s
h
a
l
l
be
b
e
consistent
c
o
n
s
i
s
t
e
n
t
acrossall
a
c
r
o
s
s
a
l
l
the
t
h
e
sub-phasesof
s
u
b
-
p
h
a
s
e
s
o
f
the
t
h
e
softwarelifecycle
s
o
f
t
w
a
r
e
l
i
f
e
c
y
c
l
e
and
a
n
d
be
b
e
compatible
c
o
m
p
a
t
i
b
l
e
with
w
i
t
h
the
t
h
e
system
s
y
s
t
e
m
and
a
n
d
hardware
h
a
r
d
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
phases,such
p
h
a
s
e
s
,
s
u
c
h
that
t
h
a
t
the
t
h
e
required
r
e
q
u
i
r
e
d
data
d
a
t
a
can
c
a
n
be
b
e
transformed
t
r
a
n
s
f
o
r
m
e
d
correctly.
c
o
r
r
e
c
t
l
y
.
NOTE
N
O
T
E
The
T
h
e
sequencing
s
e
q
u
e
n
c
i
n
g
of
o
f
phases,
p
h
a
s
e
s
,
tasks
t
a
s
k
s
and
a
n
d
activities,
a
c
t
i
v
i
t
i
e
s
,
including
i
n
c
l
u
d
i
n
g
iteration
i
t
e
r
a
t
i
o
n
steps,
s
t
e
p
s
,
for
f
o
r
the
t
h
e
software
s
o
f
t
w
a
r
e
of
o
f
an
a
n
item
i
t
e
m
is
i
s
to
t
o
ensure
e
n
s
u
r
e
the
t
h
e
consistency
c
o
n
s
i
s
t
e
n
c
y
of
o
f
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
work
w
o
r
k
products
p
r
o
d
u
c
t
s
with
w
i
t
h
the
t
h
e
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
hardware
h
a
r
d
w
a
r
e
level
l
e
v
e
l
(see
(
s
e
e
ISO
I
S
O
26262-5)
2
6
2
6
2
-
5
)
and
a
n
d
the
t
h
e
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
(see
(
s
e
e
ISO
I
S
O
26262-4).
2
6
2
6
2
-
4
)
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
2
2
hem
h
e
m
testing
t
e
s
t
i
n
g
4-8
4
-
8
tern
t
e
r
n
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
~
~
y
y
Test
T
e
s
t
phase
p
h
a
s
e
testing
t
e
s
t
i
n
g
g
g
&
&
venfication
v
e
n
f
i
c
a
t
i
o
n
S
S
Desin
D
e
s
i
n
phase
p
h
a
s
e
ven
v
e
n
cation
c
a
t
i
o
n
6-5
6
-
5
Initiation
I
n
i
t
i
a
t
i
o
n
of
o
f
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
66
6
6
Specification
S
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
equirements
e
q
u
i
r
e
m
e
n
t
s
6-7
6
-
7
Software
S
o
f
t
w
a
r
e
archilectyural
a
r
c
h
i
l
e
c
t
y
u
r
a
l
design
d
e
s
i
g
n
Software
S
o
f
t
w
a
r
e
testing
t
e
s
t
i
n
g
Test
T
e
s
t
phase
p
h
a
s
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
Software
S
o
f
t
w
a
r
e
testing
t
e
s
t
i
n
g
Test
T
e
s
t
phase
p
h
a
s
e
venfic
v
e
n
f
i
c
ation
a
t
i
o
n
a
a
ite,
i
t
e
,
8-10
8
-
1
0
Software
S
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing
t
e
s
t
i
n
g
6-11
6
-
1
1
Venfication
V
e
n
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
impleme
i
m
p
l
e
m
e
ntatio
n
t
a
t
i
o
4
4
phage
p
h
a
g
e
eric
e
r
i
c
ahon
a
h
o
n
al
a
l
—
—
NOTE
N
O
T
E
Within
W
i
t
h
i
n
the
t
h
e
figure,
f
i
g
u
r
e
,
the
t
h
e
specific
s
p
e
c
i
f
i
c
clauses
c
l
a
u
s
e
s
of
o
f
each
e
a
c
h
part
p
a
r
t
of
o
f
ISO
I
S
O
26262
2
6
2
6
2
areindicated
a
r
e
i
n
d
i
c
a
t
e
d
in
i
n
the
t
h
e
following
f
o
l
l
o
w
i
n
g
manner:
m
a
n
n
e
r
:
“m-n’,
“
m
-
n
’
,
where
w
h
e
r
e
“m”
“
m
”
represents
r
e
p
r
e
s
e
n
t
s
the
t
h
e
numberof
n
u
m
b
e
r
o
f
the
t
h
e
part
p
a
r
t
and
a
n
d
“n”
“
n
”
indicates
i
n
d
i
c
a
t
e
s
the
t
h
e
numberof
n
u
m
b
e
r
o
f
the
t
h
e
clause,
c
l
a
u
s
e
,
e.g.
e
.
g
.
“4.7”
“
4
.
7
”
represents
r
e
p
r
e
s
e
n
t
s
Clause
C
l
a
u
s
e
7
7
of
o
f
ISO
I
S
O
26262-4.
2
6
2
6
2
-
4
.
Figure
F
i
g
u
r
e
2
2
—
—
Reference
R
e
f
e
r
e
n
c
e
phase
p
h
a
s
e
modelfor
m
o
d
e
l
f
o
r
the
t
h
e
software
s
o
f
t
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
5.4.5
5
.
4
.
5
For
F
o
r
each
e
a
c
h
sub-phaseof
s
u
b
-
p
h
a
s
e
o
f
software
s
o
f
t
w
a
r
e
development,
d
e
v
e
l
o
p
m
e
n
t
,
the
t
h
e
selection
s
e
l
e
c
t
i
o
n
of
o
f
the
t
h
e
following,
f
o
l
l
o
w
i
n
g
,
including
i
n
c
l
u
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
their
t
h
e
i
r
application,
a
p
p
l
i
c
a
t
i
o
n
,
shall
s
h
a
l
l
be
b
e
carried
c
a
r
r
i
e
d
out:
o
u
t
:
-
methods;
m
e
t
h
o
d
s
;
and
a
n
d
-
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
tools.
t
o
o
l
s
.
5.4.6
5
.
4
.
6
The
T
h
e
criteria
c
r
i
t
e
r
i
a
that
t
h
a
t
shall
s
h
a
l
l
be
b
e
considered
c
o
n
s
i
d
e
r
e
d
when
w
h
e
n
selecting
s
e
l
e
c
t
i
n
g
a
a
suitable
s
u
i
t
a
b
l
e
modelling
m
o
d
e
l
l
i
n
g
or
o
r
programming
p
r
o
g
r
a
m
m
i
n
g
language
l
a
n
g
u
a
g
e
are:
a
r
e
:
.
.
-
anunambiguousdefinition;
a
n
u
n
a
m
b
i
g
u
o
u
s
d
e
f
i
n
i
t
i
o
n
;
EXAMPLE
E
X
A
M
P
L
E
Syntax
S
y
n
t
a
x
and
a
n
d
semantics
s
e
m
a
n
t
i
c
s
of
o
f
the
t
h
e
language.
l
a
n
g
u
a
g
e
.
-
the
t
h
e
support
s
u
p
p
o
r
t
for
f
o
r
embeddedreal
e
m
b
e
d
d
e
d
r
e
a
l
time
t
i
m
e
software
s
o
f
t
w
a
r
e
and
a
n
d
runtime
r
u
n
t
i
m
e
error
e
r
r
o
r
handling;
h
a
n
d
l
i
n
g
;
and
a
n
d
-
the
t
h
e
support
s
u
p
p
o
r
t
for
f
o
r
modularity,
m
o
d
u
l
a
r
i
t
y
,
abstraction
a
b
s
t
r
a
c
t
i
o
n
and
a
n
d
structured
s
t
r
u
c
t
u
r
e
d
constructs.
c
o
n
s
t
r
u
c
t
s
.
Criteria
C
r
i
t
e
r
i
a
that
t
h
a
t
are
a
r
e
not
n
o
t
sufficiently
s
u
f
f
i
c
i
e
n
t
l
y
addressed
a
d
d
r
e
s
s
e
d
by
b
y
the
t
h
e
languageitself
l
a
n
g
u
a
g
e
i
t
s
e
l
f
shall
s
h
a
l
l
be
b
e
covered
c
o
v
e
r
e
d
by
b
y
the
t
h
e
corresponding
c
o
r
r
e
s
p
o
n
d
i
n
g
guidelines,
g
u
i
d
e
l
i
n
e
s
,
or
o
r
by
b
y
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
environment.
e
n
v
i
r
o
n
m
e
n
t
.
NOTE1_
N
O
T
E
1
_
The
T
h
e
selected
s
e
l
e
c
t
e
d
programming
p
r
o
g
r
a
m
m
i
n
g
language
l
a
n
g
u
a
g
e
(such
(
s
u
c
h
as
a
s
ADA,
A
D
A
,
C,
C
,
C++,
C
+
+
,
Java,
J
a
v
a
,
Assembler
A
s
s
e
m
b
l
e
r
or
o
r
a
a
graphical
g
r
a
p
h
i
c
a
l
modelling
m
o
d
e
l
l
i
n
g
language)
l
a
n
g
u
a
g
e
)
supports
s
u
p
p
o
r
t
s
the
t
h
e
topics
t
o
p
i
c
s
given
g
i
v
e
n
in
i
n
5.4.7.
5
.
4
.
7
.
Programming
P
r
o
g
r
a
m
m
i
n
g
or
o
r
modelling
m
o
d
e
l
l
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
can
c
a
n
be
b
e
used
u
s
e
d
to
t
o
comply
c
o
m
p
l
y
with
w
i
t
h
these
t
h
e
s
e
topics.
t
o
p
i
c
s
.
NOTE2
N
O
T
E
2
Assembly
A
s
s
e
m
b
l
y
languages
l
a
n
g
u
a
g
e
s
can
c
a
n
be
b
e
usedfor
u
s
e
d
f
o
r
those
t
h
o
s
e
parts
p
a
r
t
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
where
w
h
e
r
e
the
t
h
e
use
u
s
e
of
o
f
high-level
h
i
g
h
-
l
e
v
e
l
programming
p
r
o
g
r
a
m
m
i
n
g
languagesis
l
a
n
g
u
a
g
e
s
i
s
not
n
o
t
appropriate,
a
p
p
r
o
p
r
i
a
t
e
,
such
s
u
c
h
as
a
s
low-level
l
o
w
-
l
e
v
e
l
software
s
o
f
t
w
a
r
e
with
w
i
t
h
interfaces
i
n
t
e
r
f
a
c
e
s
to
t
o
the
t
h
e
hardware,
h
a
r
d
w
a
r
e
,
interrupt
i
n
t
e
r
r
u
p
t
handlers,ortime-critical
h
a
n
d
l
e
r
s
,
o
r
t
i
m
e
-
c
r
i
t
i
c
a
l
algorithms.
a
l
g
o
r
i
t
h
m
s
.
;
;
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
5.4.7
5
.
4
.
7
To
T
o
support
s
u
p
p
o
r
t
the
t
h
e
correctnessof
c
o
r
r
e
c
t
n
e
s
s
o
f
the
t
h
e
design
d
e
s
i
g
n
and
a
n
d
implementation,
i
m
p
l
e
m
e
n
t
a
t
i
o
n
,
the
t
h
e
design
d
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
modelling,
m
o
d
e
l
l
i
n
g
,
or
o
r
programming
p
r
o
g
r
a
m
m
i
n
g
languages,shall
l
a
n
g
u
a
g
e
s
,
s
h
a
l
l
addressthetopicslisted
a
d
d
r
e
s
s
t
h
e
t
o
p
i
c
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
1.
1
.
NOTE
N
O
T
E
1
1
Coding
C
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
are
a
r
e
usually
u
s
u
a
l
l
y
different
d
i
f
f
e
r
e
n
t
for
f
o
r
different
d
i
f
f
e
r
e
n
t
programming
p
r
o
g
r
a
m
m
i
n
g
languages.
l
a
n
g
u
a
g
e
s
.
NOTE
N
O
T
E
2
2
Coding
C
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
can
c
a
n
be
b
e
different
d
i
f
f
e
r
e
n
t
for
f
o
r
model-based
m
o
d
e
l
-
b
a
s
e
d
development.
d
e
v
e
l
o
p
m
e
n
t
.
NOTE3
N
O
T
E
3
Existing
E
x
i
s
t
i
n
g
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
can
c
a
n
be
b
e
modified
m
o
d
i
f
i
e
d
for
f
o
r
a
a
specific
s
p
e
c
i
f
i
c
item
i
t
e
m
development.
d
e
v
e
l
o
p
m
e
n
t
.
EXAMPLE
E
X
A
M
P
L
E
MISRA
M
I
S
R
A
Cl]
C
l
]
and
a
n
d
MISRA
M
I
S
R
A
AC
A
C
AGC"are
A
G
C
"
a
r
e
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
programming
p
r
o
g
r
a
m
m
i
n
g
languageC.
l
a
n
g
u
a
g
e
C
.
Table
T
a
b
l
e
1
1
—
—
Topics
T
o
p
i
c
s
to
t
o
be
b
e
covered
c
o
v
e
r
e
d
by
b
y
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
Enforcement
E
n
f
o
r
c
e
m
e
n
t
of
o
f
low
l
o
w
complexity#
c
o
m
p
l
e
x
i
t
y
#
Use
U
s
e
of
o
f
language
l
a
n
g
u
a
g
e
subsets®
s
u
b
s
e
t
s
®
Enforcementof
E
n
f
o
r
c
e
m
e
n
t
o
f
strong
s
t
r
o
n
g
typing
t
y
p
i
n
g
Use
U
s
e
of
o
f
defensive
d
e
f
e
n
s
i
v
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
techniques
t
e
c
h
n
i
q
u
e
s
Use
U
s
e
of
o
f
established
e
s
t
a
b
l
i
s
h
e
d
design
d
e
s
i
g
n
principles
p
r
i
n
c
i
p
l
e
s
Use
U
s
e
of
o
f
unambiguousgraphical
u
n
a
m
b
i
g
u
o
u
s
g
r
a
p
h
i
c
a
l
representation
r
e
p
r
e
s
e
n
t
a
t
i
o
n
Use
U
s
e
of
o
f
style
s
t
y
l
e
guides
g
u
i
d
e
s
Use
U
s
e
of
o
f
naming
n
a
m
i
n
g
conventions
c
o
n
v
e
n
t
i
o
n
s
An
A
n
appropriate
a
p
p
r
o
p
r
i
a
t
e
compromise
c
o
m
p
r
o
m
i
s
e
of
o
f
this
t
h
i
s
topic
t
o
p
i
c
with
w
i
t
h
other
o
t
h
e
r
methodsin
m
e
t
h
o
d
s
i
n
this
t
h
i
s
part
p
a
r
t
of
o
f
ISO
I
S
O
26262
2
6
2
6
2
may
m
a
y
be
b
e
required.
r
e
q
u
i
r
e
d
.
The
T
h
e
objectives
o
b
j
e
c
t
i
v
e
s
of
o
f
method
m
e
t
h
o
d
1b
1
b
are
a
r
e
Exclusion
E
x
c
l
u
s
i
o
n
of
o
f
ambiguously
a
m
b
i
g
u
o
u
s
l
y
defined
d
e
f
i
n
e
d
language
l
a
n
g
u
a
g
e
constructs
c
o
n
s
t
r
u
c
t
s
which
w
h
i
c
h
may
m
a
y
be
b
e
interpreted
i
n
t
e
r
p
r
e
t
e
d
differently
d
i
f
f
e
r
e
n
t
l
y
by
b
y
different
d
i
f
f
e
r
e
n
t
modellers,
m
o
d
e
l
l
e
r
s
,
programmers,
p
r
o
g
r
a
m
m
e
r
s
,
code
c
o
d
e
generators
g
e
n
e
r
a
t
o
r
s
or
o
r
compilers.
c
o
m
p
i
l
e
r
s
.
Exclusion
E
x
c
l
u
s
i
o
n
of
o
f
language
l
a
n
g
u
a
g
e
constructs
c
o
n
s
t
r
u
c
t
s
which
w
h
i
c
h
from
f
r
o
m
experience
e
x
p
e
r
i
e
n
c
e
easily
e
a
s
i
l
y
lead
l
e
a
d
to
t
o
mistakes,
m
i
s
t
a
k
e
s
,
for
f
o
r
example
e
x
a
m
p
l
e
assignments
a
s
s
i
g
n
m
e
n
t
s
in
i
n
conditions
c
o
n
d
i
t
i
o
n
s
or
o
r
identical
i
d
e
n
t
i
c
a
l
naming
n
a
m
i
n
g
of
o
f
local
l
o
c
a
l
and
a
n
d
global
g
l
o
b
a
l
variables.
v
a
r
i
a
b
l
e
s
.
Exclusion
E
x
c
l
u
s
i
o
n
of
o
f
language
l
a
n
g
u
a
g
e
constructs
c
o
n
s
t
r
u
c
t
s
which
w
h
i
c
h
could
c
o
u
l
d
result
r
e
s
u
l
t
in
i
n
unhandled
u
n
h
a
n
d
l
e
d
run-time
r
u
n
-
t
i
m
e
errors.
e
r
r
o
r
s
.
The
T
h
e
objective
o
b
j
e
c
t
i
v
e
of
o
f
method
m
e
t
h
o
d
1c
1
c
is
i
s
to
t
o
imposeprinciples
i
m
p
o
s
e
p
r
i
n
c
i
p
l
e
s
of
o
f
strong
s
t
r
o
n
g
typing
t
y
p
i
n
g
where
w
h
e
r
e
these
t
h
e
s
e
are
a
r
e
not
n
o
t
inherentin
i
n
h
e
r
e
n
t
i
n
the
t
h
e
language.
l
a
n
g
u
a
g
e
.
5.5
5
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
5.5.1
5
.
5
.
1
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
5.4.1
5
.
4
.
1
to
t
o
5.4.7.
5
.
4
.
7
.
5.5.2
5
.
5
.
2
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
5.4.1
5
.
4
.
1
to
t
o
5.4.5
5
.
4
.
5
and
a
n
d
5.4.7.
5
.
4
.
7
.
5.5.3
5
.
5
.
3
Design
D
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
languages
l
a
n
g
u
a
g
e
s
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
5.4.6
5
.
4
.
6
and
a
n
d
5.4.7.
5
.
4
.
7
.
5.5.4
5
.
5
.
4
Tool
T
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
5.4.5
5
.
4
.
5
and
a
n
d
5.4.6.
5
.
4
.
6
.
6
6
Specification
S
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
6.1
6
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
first
f
i
r
s
t
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
is
i
s
to
t
o
specify
s
p
e
c
i
f
y
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
They
T
h
e
y
are
a
r
e
derived
d
e
r
i
v
e
d
from
f
r
o
m
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
and
a
n
d
the
t
h
e
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification.
s
p
e
c
i
f
i
c
a
t
i
o
n
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
a
a
The
T
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
refined
r
e
f
i
n
e
d
and
a
n
d
allocated
a
l
l
o
c
a
t
e
d
to
t
o
hardware
h
a
r
d
w
a
r
e
and
a
n
d
software
s
o
f
t
w
a
r
e
during
d
u
r
i
n
g
the
t
h
e
system
s
y
s
t
e
m
design
d
e
s
i
g
n
phase
p
h
a
s
e
given
g
i
v
e
n
in
i
n
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Clause
C
l
a
u
s
e
7.
7
.
The
T
h
e
Specification
S
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
The
T
h
e
second
s
e
c
o
n
d
objective
o
b
j
e
c
t
i
v
e
is
i
s
to
t
o
detail
d
e
t
a
i
l
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
requirementsinitiated
r
e
q
u
i
r
e
m
e
n
t
s
i
n
i
t
i
a
t
e
d
in
i
n
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Clause7.
C
l
a
u
s
e
7
.
The
T
h
e
third
t
h
i
r
d
objective
o
b
j
e
c
t
i
v
e
is
i
s
to
t
o
verify
v
e
r
i
f
y
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
consistentwith
c
o
n
s
i
s
t
e
n
t
w
i
t
h
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
and
a
n
d
the
t
h
e
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification.
s
p
e
c
i
f
i
c
a
t
i
o
n
.
6.2
6
.
2
General
G
e
n
e
r
a
l
considers
c
o
n
s
i
d
e
r
s
constraints
c
o
n
s
t
r
a
i
n
t
s
of
o
f
the
t
h
e
hardware
h
a
r
d
w
a
r
e
and
a
n
d
the
t
h
e
impact
i
m
p
a
c
t
of
o
f
these
t
h
e
s
e
constraints
c
o
n
s
t
r
a
i
n
t
s
on
o
n
the
t
h
e
software.
s
o
f
t
w
a
r
e
.
This
T
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
includes
i
n
c
l
u
d
e
s
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
Safety
S
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
to
t
o
support
s
u
p
p
o
r
t
the
t
h
e
subsequent
s
u
b
s
e
q
u
e
n
t
design
d
e
s
i
g
n
phases.
p
h
a
s
e
s
.
6.3
6
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
6.3.1
6
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
Thefollowing
T
h
e
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
THA
T
H
A
—
—
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.2:
7
.
5
.
2
:
—
—
hardware-softwareinterface
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:201
2
6
2
6
2
-
4
:
2
0
1
Ws
W
s
12520;
1
2
5
2
0
;
—
—
safety
s
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
5.5.1;
5
.
5
.
1
;
—
—
software
s
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.2.
5
.
5
.
2
.
6.3.2
6
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
hardware
h
a
r
d
w
a
r
e
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-5:2011,
2
6
2
6
2
-
5
:
2
0
1
1
,
(DA);
(
D
A
)
;
—
—
guidelinesfor
g
u
i
d
e
l
i
n
e
s
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
6.4
6
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
6.4.1
6
.
4
.
1
The
T
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
address
a
d
d
r
e
s
s
each
e
a
c
h
software-based
s
o
f
t
w
a
r
e
-
b
a
s
e
d
function
f
u
n
c
t
i
o
n
whosefailure
w
h
o
s
e
f
a
i
l
u
r
e
could
c
o
u
l
d
lead
l
e
a
d
to
t
o
a
a
violation
v
i
o
l
a
t
i
o
n
of
o
f
a
a
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
requirementallocated
r
e
q
u
i
r
e
m
e
n
t
a
l
l
o
c
a
t
e
d
to
t
o
software.
s
o
f
t
w
a
r
e
.
EXAMPLE
E
X
A
M
P
L
E
Functions
F
u
n
c
t
i
o
n
s
whosefailure
w
h
o
s
e
f
a
i
l
u
r
e
could
c
o
u
l
d
lead
l
e
a
d
toa
t
o
a
violation
v
i
o
l
a
t
i
o
n
of
o
f
a
a
safety
s
a
f
e
t
y
requirement
r
e
q
u
i
r
e
m
e
n
t
can
c
a
n
be:
b
e
:
—
—
functions
f
u
n
c
t
i
o
n
s
that
t
h
a
t
enable
e
n
a
b
l
e
the
t
h
e
system
s
y
s
t
e
m
to
t
o
achieve
a
c
h
i
e
v
e
or
o
r
maintain
m
a
i
n
t
a
i
n
a
a
safe
s
a
f
e
state:
s
t
a
t
e
:
—
—
functionsrelated
f
u
n
c
t
i
o
n
s
r
e
l
a
t
e
d
to
t
o
the
t
h
e
detection,
d
e
t
e
c
t
i
o
n
,
indication
i
n
d
i
c
a
t
i
o
n
and
a
n
d
handling
h
a
n
d
l
i
n
g
offaults
o
f
f
a
u
l
t
s
of
o
f
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
hardware
h
a
r
d
w
a
r
e
elements:
e
l
e
m
e
n
t
s
:
—
—
functions
f
u
n
c
t
i
o
n
s
related
r
e
l
a
t
e
d
to
t
o
the
t
h
e
detection,
d
e
t
e
c
t
i
o
n
,
notification
n
o
t
i
f
i
c
a
t
i
o
n
and
a
n
d
mitigation
m
i
t
i
g
a
t
i
o
n
of
o
f
faults
f
a
u
l
t
s
in
i
n
the
t
h
e
softwareitself:
s
o
f
t
w
a
r
e
i
t
s
e
l
f
:
NOTE
N
O
T
E
1
1
Theseinclude
T
h
e
s
e
i
n
c
l
u
d
e
both
b
o
t
h
the
t
h
e
self-monitoring
s
e
l
f
-
m
o
n
i
t
o
r
i
n
g
of
o
f
the
t
h
e
softwarein
s
o
f
t
w
a
r
e
i
n
the
t
h
e
operating
o
p
e
r
a
t
i
n
g
system
s
y
s
t
e
m
and
a
n
d
application-specific
a
p
p
l
i
c
a
t
i
o
n
-
s
p
e
c
i
f
i
c
self-
s
e
l
f
-
monitoring
m
o
n
i
t
o
r
i
n
g
of
o
f
the
t
h
e
softwareto
s
o
f
t
w
a
r
e
t
o
detect,
d
e
t
e
c
t
,
indicate
i
n
d
i
c
a
t
e
and
a
n
d
handle
h
a
n
d
l
e
systematic
s
y
s
t
e
m
a
t
i
c
faults
f
a
u
l
t
s
in
i
n
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
software.
s
o
f
t
w
a
r
e
.
—
—
functionsrelated
f
u
n
c
t
i
o
n
s
r
e
l
a
t
e
d
to
t
o
on-board
o
n
-
b
o
a
r
d
andoff-board
a
n
d
o
f
f
-
b
o
a
r
d
tests:
t
e
s
t
s
:
NOTE
N
O
T
E
2
2
On-board
O
n
-
b
o
a
r
d
tests
t
e
s
t
s
can
c
a
n
be
b
e
carried
c
a
r
r
i
e
d
out
o
u
t
by
b
y
the
t
h
e
system
s
y
s
t
e
m
itself
i
t
s
e
l
f
or
o
r
through
t
h
r
o
u
g
h
other
o
t
h
e
r
systems
s
y
s
t
e
m
s
within
w
i
t
h
i
n
the
t
h
e
vehicle
v
e
h
i
c
l
e
network
n
e
t
w
o
r
k
during
d
u
r
i
n
g
operation
o
p
e
r
a
t
i
o
n
and
a
n
d
during
d
u
r
i
n
g
the
t
h
e
pre-run
p
r
e
-
r
u
n
and
a
n
d
post-run
p
o
s
t
-
r
u
n
phase
p
h
a
s
e
ofthe
o
f
t
h
e
vehicle.
v
e
h
i
c
l
e
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
NOTE
N
O
T
E
3
3
Off-board
O
f
f
-
b
o
a
r
d
tests
t
e
s
t
s
refer
r
e
f
e
r
to
t
o
the
t
h
e
testing
t
e
s
t
i
n
g
of
o
f
the
t
h
e
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
functions
f
u
n
c
t
i
o
n
s
or
o
r
properties
p
r
o
p
e
r
t
i
e
s
during
d
u
r
i
n
g
production
p
r
o
d
u
c
t
i
o
n
or
o
r
in
i
n
service.
s
e
r
v
i
c
e
.
—
—
functionsthat
f
u
n
c
t
i
o
n
s
t
h
a
t
allow
a
l
l
o
w
modifications
m
o
d
i
f
i
c
a
t
i
o
n
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
during
d
u
r
i
n
g
production
p
r
o
d
u
c
t
i
o
n
and
a
n
d
service:
s
e
r
v
i
c
e
:
and
a
n
d
—
—
functionsrelated
f
u
n
c
t
i
o
n
s
r
e
l
a
t
e
d
to
t
o
performance
p
e
r
f
o
r
m
a
n
c
e
or
o
r
time-critical
t
i
m
e
-
c
r
i
t
i
c
a
l
operations.
o
p
e
r
a
t
i
o
n
s
.
6.4.2
6
.
4
.
2
The
T
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
be
b
e
derived
d
e
r
i
v
e
d
from
f
r
o
m
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
and
a
n
d
the
t
h
e
system
s
y
s
t
e
m
design
d
e
s
i
g
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.4.1
7
.
4
.
1
and
a
n
d
7.4.5,
7
.
4
.
5
,
and
a
n
d
shall
s
h
a
l
l
consider:
c
o
n
s
i
d
e
r
:
-
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
and
a
n
d
management
m
a
n
a
g
e
m
e
n
t
of
o
f
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
6;
6
;
-
the
t
h
e
specified
s
p
e
c
i
f
i
e
d
system
s
y
s
t
e
m
and
a
n
d
hardware
h
a
r
d
w
a
r
e
configurations;
c
o
n
f
i
g
u
r
a
t
i
o
n
s
;
EXAMPLE
E
X
A
M
P
L
E
1
1
Configuration
C
o
n
f
i
g
u
r
a
t
i
o
n
parameters
p
a
r
a
m
e
t
e
r
s
can
c
a
n
include
i
n
c
l
u
d
e
gain
g
a
i
n
control,
c
o
n
t
r
o
l
,
band
b
a
n
d
pass
p
a
s
s
frequencyandclock
f
r
e
q
u
e
n
c
y
a
n
d
c
l
o
c
k
prescaler.
p
r
e
s
c
a
l
e
r
.
-
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification:
s
p
e
c
i
f
i
c
a
t
i
o
n
:
-
the
t
h
e
relevant
r
e
l
e
v
a
n
t
requirements
r
e
q
u
i
r
e
m
e
n
t
s
of
o
f
the
t
h
e
hardware
h
a
r
d
w
a
r
e
design
d
e
s
i
g
n
specification;
s
p
e
c
i
f
i
c
a
t
i
o
n
;
-
the
t
h
e
timing
t
i
m
i
n
g
constraints;
c
o
n
s
t
r
a
i
n
t
s
;
EXAMPLE
E
X
A
M
P
L
E
2
2
Execution
E
x
e
c
u
t
i
o
n
or
o
r
reaction
r
e
a
c
t
i
o
n
time
t
i
m
e
derived
d
e
r
i
v
e
d
from
f
r
o
m
the
t
h
e
required
r
e
q
u
i
r
e
d
responsetime
r
e
s
p
o
n
s
e
t
i
m
e
at
a
t
the
t
h
e
system
s
y
s
t
e
m
level.
l
e
v
e
l
.
-
the
t
h
e
external
e
x
t
e
r
n
a
l
interfaces;
i
n
t
e
r
f
a
c
e
s
;
and
a
n
d
EXAMPLE
E
X
A
M
P
L
E
3.
3
.
Communication
C
o
m
m
u
n
i
c
a
t
i
o
n
and
a
n
d
userinterfaces.
u
s
e
r
i
n
t
e
r
f
a
c
e
s
.
-
each
e
a
c
h
operating
o
p
e
r
a
t
i
n
g
modeofthe
m
o
d
e
o
f
t
h
e
vehicle,
v
e
h
i
c
l
e
,
the
t
h
e
system,
s
y
s
t
e
m
,
or
o
r
the
t
h
e
hardware,
h
a
r
d
w
a
r
e
,
having
h
a
v
i
n
g
an
a
n
impact
i
m
p
a
c
t
on
o
n
the
t
h
e
software.
s
o
f
t
w
a
r
e
.
EXAMPLE
E
X
A
M
P
L
E
4
4
Operating
O
p
e
r
a
t
i
n
g
modesof
m
o
d
e
s
o
f
hardware
h
a
r
d
w
a
r
e
devices
d
e
v
i
c
e
s
caninclude
c
a
n
i
n
c
l
u
d
e
default,initialization,
d
e
f
a
u
l
t
,
i
n
i
t
i
a
l
i
z
a
t
i
o
n
,
test,
t
e
s
t
,
and
a
n
d
advanced
a
d
v
a
n
c
e
d
modes.
m
o
d
e
s
.
6.4.3
6
.
4
.
3
If
I
f
ASIL
A
S
I
L
decomposition
d
e
c
o
m
p
o
s
i
t
i
o
n
is
i
s
applied
a
p
p
l
i
e
d
to
t
o
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Clause
C
l
a
u
s
e
5,
5
,
shall
s
h
a
l
l
be
b
e
complied
c
o
m
p
l
i
e
d
with.
w
i
t
h
.
6.4.4
6
.
4
.
4
The
T
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
initiated
i
n
i
t
i
a
t
e
d
in
i
n
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Clause
C
l
a
u
s
e
7,
7
,
shall
s
h
a
l
l
be
b
e
detailed
d
e
t
a
i
l
e
d
down
d
o
w
n
to
t
o
a
a
level
l
e
v
e
l
allowing
a
l
l
o
w
i
n
g
the
t
h
e
correct
c
o
r
r
e
c
t
control.
c
o
n
t
r
o
l
.
and
a
n
d
usage
u
s
a
g
e
of
o
f
hardware,
h
a
r
d
w
a
r
e
,
and
a
n
d
shall
s
h
a
l
l
describe
d
e
s
c
r
i
b
e
each
e
a
c
h
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
dependency
d
e
p
e
n
d
e
n
c
y
between
b
e
t
w
e
e
n
hardware
h
a
r
d
w
a
r
e
and
a
n
d
software.
s
o
f
t
w
a
r
e
.
6.4.5
6
.
4
.
5
If
I
f
other
o
t
h
e
r
functions
f
u
n
c
t
i
o
n
s
in
i
n
addition
a
d
d
i
t
i
o
n
to
t
o
those
t
h
o
s
e
functions
f
u
n
c
t
i
o
n
s
for
f
o
r
which
w
h
i
c
h
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
specified
s
p
e
c
i
f
i
e
d
in
i
n
6.4.1
6
.
4
.
1
are
a
r
e
carried
c
a
r
r
i
e
d
out
o
u
t
by
b
y
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software,
s
o
f
t
w
a
r
e
,
these
t
h
e
s
e
functions
f
u
n
c
t
i
o
n
s
shall
s
h
a
l
l
be
b
e
specified,
s
p
e
c
i
f
i
e
d
,
or
o
r
else
e
l
s
e
a
a
reference
r
e
f
e
r
e
n
c
e
madeto
m
a
d
e
t
o
their
t
h
e
i
r
specification.
s
p
e
c
i
f
i
c
a
t
i
o
n
.
6.4.6
6
.
4
.
6
The
T
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
of
o
f
the
t
h
e
refined
r
e
f
i
n
e
d
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
hardware
h
a
r
d
w
a
r
e
software
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
shall
s
h
a
l
l
be
b
e
planned
p
l
a
n
n
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9.
9
.
6.4.7
6
.
4
.
7
The
T
h
e
refined
r
e
f
i
n
e
d
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
verified
v
e
r
i
f
i
e
d
jointly
j
o
i
n
t
l
y
by
b
y
the
t
h
e
persons
p
e
r
s
o
n
s
responsible
r
e
s
p
o
n
s
i
b
l
e
for
f
o
r
the
t
h
e
system,
s
y
s
t
e
m
,
hardware
h
a
r
d
w
a
r
e
and
a
n
d
software
s
o
f
t
w
a
r
e
development.
d
e
v
e
l
o
p
m
e
n
t
.
6.4.8
6
.
4
.
8
The
T
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
the
t
h
e
refined
r
e
f
i
n
e
d
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
be
b
e
verified
v
e
r
i
f
i
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clauses
C
l
a
u
s
e
s
6
6
and
a
n
d
9,
9
,
to
t
o
show
s
h
o
w
their:
t
h
e
i
r
:
-
compliance
c
o
m
p
l
i
a
n
c
e
and
a
n
d
consistency
c
o
n
s
i
s
t
e
n
c
y
with
w
i
t
h
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
requirements;
r
e
q
u
i
r
e
m
e
n
t
s
;
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
system
s
y
s
t
e
m
design;
d
e
s
i
g
n
;
and
a
n
d
-
consistency
c
o
n
s
i
s
t
e
n
c
y
with
w
i
t
h
the
t
h
e
hardware-softwareinterface.
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ee
e
e
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
6.5
6
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
6.5.1
6
.
5
.
1
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
6.4.1
6
.
4
.
1
to
t
o
6.4.3
6
.
4
.
3
and
a
n
d
6.4.5.
6
.
4
.
5
.
6.5.2
6
.
5
.
2
Hardware-softwareinterface
H
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
6.4.4.
6
.
4
.
4
.
NOTE
N
O
T
E
This
T
h
i
s
work
w
o
r
k
productrefers
p
r
o
d
u
c
t
r
e
f
e
r
s
to
t
o
the
t
h
e
same
s
a
m
e
work
w
o
r
k
product
p
r
o
d
u
c
t
as
a
s
given
g
i
v
e
n
in
i
n
ISO
I
S
O
26262-5:2011
2
6
2
6
2
-
5
:
2
0
1
1
6.5.2
6
.
5
.
2
6.5.3
6
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement6.4.6.
r
e
q
u
i
r
e
m
e
n
t
6
.
4
.
6
.
6.5.4
6
.
5
.
4
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
6.4.7
6
.
4
.
7
and
a
n
d
6.4.8.
6
.
4
.
8
.
7
7
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
7.1
7
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
Thefirst
T
h
e
f
i
r
s
t
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
is
i
s
to
t
o
develop
d
e
v
e
l
o
p
a
a
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
that
t
h
a
t
realizes
r
e
a
l
i
z
e
s
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
The
T
h
e
second
s
e
c
o
n
d
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phaseis
s
u
b
-
p
h
a
s
e
i
s
to
t
o
verify
v
e
r
i
f
y
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design.
d
e
s
i
g
n
.
7.2
7
.
2
General
G
e
n
e
r
a
l
The
T
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
represents
r
e
p
r
e
s
e
n
t
s
all
a
l
l
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
andtheir
a
n
d
t
h
e
i
r
interactions
i
n
t
e
r
a
c
t
i
o
n
s
in
i
n
a
a
hierarchical
h
i
e
r
a
r
c
h
i
c
a
l
structure.
s
t
r
u
c
t
u
r
e
.
Static
S
t
a
t
i
c
aspects,
a
s
p
e
c
t
s
,
such
s
u
c
h
as
a
s
interfaces
i
n
t
e
r
f
a
c
e
s
and
a
n
d
data
d
a
t
a
paths
p
a
t
h
s
between
b
e
t
w
e
e
n
all
a
l
l
software
s
o
f
t
w
a
r
e
components,
c
o
m
p
o
n
e
n
t
s
,
as
a
s
well
w
e
l
l
as
a
s
dynamic
d
y
n
a
m
i
c
aspects,
a
s
p
e
c
t
s
,
such
s
u
c
h
as
a
s
process
p
r
o
c
e
s
s
sequencesand
s
e
q
u
e
n
c
e
s
a
n
d
timing
t
i
m
i
n
g
behaviour
b
e
h
a
v
i
o
u
r
are
a
r
e
described.
d
e
s
c
r
i
b
e
d
.
NOTE
N
O
T
E
The
T
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
is
i
s
not
n
o
t
necessarily
n
e
c
e
s
s
a
r
i
l
y
limited
l
i
m
i
t
e
d
to
t
o
one
o
n
e
microcontroller
m
i
c
r
o
c
o
n
t
r
o
l
l
e
r
or
o
r
ECU,
E
C
U
,
andis
a
n
d
i
s
related
r
e
l
a
t
e
d
to
t
o
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
and
a
n
d
system
s
y
s
t
e
m
design.
d
e
s
i
g
n
.
The
T
h
e
software
s
o
f
t
w
a
r
e
architecture
a
r
c
h
i
t
e
c
t
u
r
e
for
f
o
r
each
e
a
c
h
microcontroller
m
i
c
r
o
c
o
n
t
r
o
l
l
e
r
is
i
s
also
a
l
s
o
addressed
a
d
d
r
e
s
s
e
d
by
b
y
this
t
h
i
s
chapter.
c
h
a
p
t
e
r
.
:
:
In
I
n
order
o
r
d
e
r
to
t
o
develop
d
e
v
e
l
o
p
a
a
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
both
b
o
t
h
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
as
a
s
well
w
e
l
l
as
a
s
all
a
l
l
non-safety-
n
o
n
-
s
a
f
e
t
y
-
related
r
e
l
a
t
e
d
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
implemented.
i
m
p
l
e
m
e
n
t
e
d
.
Hence
H
e
n
c
e
in
i
n
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
and
a
n
d
non-safety-related
n
o
n
-
s
a
f
e
t
y
-
r
e
l
a
t
e
d
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
handled
h
a
n
d
l
e
d
within
w
i
t
h
i
n
one
o
n
e
developmentprocess.
d
e
v
e
l
o
p
m
e
n
t
p
r
o
c
e
s
s
.
The
T
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
provides
p
r
o
v
i
d
e
s
the
t
h
e
meansto
m
e
a
n
s
t
o
implement
i
m
p
l
e
m
e
n
t
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
to
t
o
manage
m
a
n
a
g
e
the
t
h
e
complexity
c
o
m
p
l
e
x
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
development.
d
e
v
e
l
o
p
m
e
n
t
.
7.3
7
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
7.3.1
7
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
safety
s
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.1:
5
.
5
.
1
:
—
—
design
d
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
languagesin
l
a
n
g
u
a
g
e
s
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.3;
5
.
5
.
3
;
—
—
_hardware-softwareinterface
_
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.3;
7
.
5
.
3
;
—
—
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
6.5.1;
6
.
5
.
1
;
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
6.5.3;
6
.
5
.
3
;
and
a
n
d
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
6.5.4.
6
.
5
.
4
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
7.3.2
7
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.1):
7
.
5
.
1
)
:
—
—
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.2);
7
.
5
.
2
)
;
—
—
qualified
q
u
a
l
i
f
i
e
d
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
available
a
v
a
i
l
a
b
l
e
(see
(
s
e
e
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
12);
1
2
)
;
—
—
tool
t
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.4;
5
.
5
.
4
;
and
a
n
d
—
—
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
7.4
7
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
7.4.1.
7
.
4
.
1
.
To
T
o
ensure
e
n
s
u
r
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
captures
c
a
p
t
u
r
e
s
the
t
h
e
information
i
n
f
o
r
m
a
t
i
o
n
necessary
n
e
c
e
s
s
a
r
y
to
t
o
allow
a
l
l
o
w
the
t
h
e
subsequent
s
u
b
s
e
q
u
e
n
t
developmentactivities
d
e
v
e
l
o
p
m
e
n
t
a
c
t
i
v
i
t
i
e
s
to
t
o
be
b
e
performed
p
e
r
f
o
r
m
e
d
correctly
c
o
r
r
e
c
t
l
y
and
a
n
d
effectively,
e
f
f
e
c
t
i
v
e
l
y
,
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
shall
s
h
a
l
l
be
b
e
described
d
e
s
c
r
i
b
e
d
with
w
i
t
h
appropriate
a
p
p
r
o
p
r
i
a
t
e
levels
l
e
v
e
l
s
of
o
f
abstraction
a
b
s
t
r
a
c
t
i
o
n
by
b
y
using
u
s
i
n
g
the
t
h
e
notations
n
o
t
a
t
i
o
n
s
for
f
o
r
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
designlisted
d
e
s
i
g
n
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
2.
2
.
Table
T
a
b
l
e
2
2
—
—
Notations
N
o
t
a
t
i
o
n
s
for
f
o
r
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
Methods
M
e
t
h
o
d
s
Informal
I
n
f
o
r
m
a
l
notations
n
o
t
a
t
i
o
n
s
1b
1
b
|
|
Semi-formal
S
e
m
i
-
f
o
r
m
a
l
notations
n
o
t
a
t
i
o
n
s
1c
1
c
Formal
F
o
r
m
a
l
notations
n
o
t
a
t
i
o
n
s
7.4.2
7
.
4
.
2
During
D
u
r
i
n
g
the
t
h
e
developmentof
d
e
v
e
l
o
p
m
e
n
t
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
the
t
h
e
following
f
o
l
l
o
w
i
n
g
shall
s
h
a
l
l
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
-
theverifiability
t
h
e
v
e
r
i
f
i
a
b
i
l
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design;
d
e
s
i
g
n
;
NOTE
N
O
T
E
This
T
h
i
s
implies
i
m
p
l
i
e
s
bi-directional
b
i
-
d
i
r
e
c
t
i
o
n
a
l
traceability
t
r
a
c
e
a
b
i
l
i
t
y
between
b
e
t
w
e
e
n
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
and
a
n
d
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
-
the
t
h
e
suitability
s
u
i
t
a
b
i
l
i
t
y
for
f
o
r
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software;
s
o
f
t
w
a
r
e
;
-
the
t
h
e
feasibility
f
e
a
s
i
b
i
l
i
t
y
for
f
o
r
the
t
h
e
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
units;
u
n
i
t
s
;
-
the
t
h
e
testability
t
e
s
t
a
b
i
l
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
architecture
a
r
c
h
i
t
e
c
t
u
r
e
during
d
u
r
i
n
g
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing;
t
e
s
t
i
n
g
;
and
a
n
d
-
the
t
h
e
maintainability
m
a
i
n
t
a
i
n
a
b
i
l
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design.
d
e
s
i
g
n
.
7.4.3
7
.
4
.
3
In
I
n
order
o
r
d
e
r
to
t
o
avoidfailures
a
v
o
i
d
f
a
i
l
u
r
e
s
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
high
h
i
g
h
complexity,
c
o
m
p
l
e
x
i
t
y
,
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
shall
s
h
a
l
l
exhibit
e
x
h
i
b
i
t
the
t
h
e
following
f
o
l
l
o
w
i
n
g
properties
p
r
o
p
e
r
t
i
e
s
by
b
y
use
u
s
e
of
o
f
the
t
h
e
principleslisted
p
r
i
n
c
i
p
l
e
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
3:
3
:
-
modularity;
m
o
d
u
l
a
r
i
t
y
;
-
encapsulation;
e
n
c
a
p
s
u
l
a
t
i
o
n
;
and
a
n
d
-
simplicity.
s
i
m
p
l
i
c
i
t
y
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Table
T
a
b
l
e
3
3
—
—
Principles
P
r
i
n
c
i
p
l
e
s
for
f
o
r
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
Hierarchical
H
i
e
r
a
r
c
h
i
c
a
l
structure
s
t
r
u
c
t
u
r
e
of
o
f
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
Restricted
R
e
s
t
r
i
c
t
e
d
size
s
i
z
e
of
o
f
interfaces?
i
n
t
e
r
f
a
c
e
s
?
High
H
i
g
h
cohesion
c
o
h
e
s
i
o
n
within
w
i
t
h
i
n
each
e
a
c
h
software
s
o
f
t
w
a
r
e
component
c
o
m
p
o
n
e
n
t
Restricted
R
e
s
t
r
i
c
t
e
d
coupling
c
o
u
p
l
i
n
g
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
components®:©:
c
o
m
p
o
n
e
n
t
s
®
:
©
:
¢
¢
|
|
Appropriate
A
p
p
r
o
p
r
i
a
t
e
scheduling
s
c
h
e
d
u
l
i
n
g
properties
p
r
o
p
e
r
t
i
e
s
Restricted
R
e
s
t
r
i
c
t
e
d
useof
u
s
e
o
f
interrupts?4
i
n
t
e
r
r
u
p
t
s
?
4
In
I
n
methods
m
e
t
h
o
d
s
1b,
1
b
,
1c,
1
c
,
1e
1
e
and
a
n
d
1g
1
g
"restricted"
"
r
e
s
t
r
i
c
t
e
d
"
means
m
e
a
n
s
to
t
o
minimize
m
i
n
i
m
i
z
e
in
i
n
balance
b
a
l
a
n
c
e
with
w
i
t
h
other
o
t
h
e
r
design
d
e
s
i
g
n
considerations.
c
o
n
s
i
d
e
r
a
t
i
o
n
s
.
5
5
Methods
M
e
t
h
o
d
s
1d
1
d
and1e
a
n
d
1
e
can,
c
a
n
,
for
f
o
r
example,
e
x
a
m
p
l
e
,
be
b
e
achieved
a
c
h
i
e
v
e
d
by
b
y
separation
s
e
p
a
r
a
t
i
o
n
of
o
f
concernswhichrefers
c
o
n
c
e
r
n
s
w
h
i
c
h
r
e
f
e
r
s
to
t
o
the
t
h
e
ability
a
b
i
l
i
t
y
to
t
o
identify,
i
d
e
n
t
i
f
y
,
encapsulate,
e
n
c
a
p
s
u
l
a
t
e
,
and
a
n
d
manipulate
m
a
n
i
p
u
l
a
t
e
thoseparts
t
h
o
s
e
p
a
r
t
s
of
o
f
software
s
o
f
t
w
a
r
e
that
t
h
a
t
are
a
r
e
relevant
r
e
l
e
v
a
n
t
to
t
o
a
a
particular
p
a
r
t
i
c
u
l
a
r
concept,
c
o
n
c
e
p
t
,
goal,
g
o
a
l
,
task,
t
a
s
k
,
or
o
r
purpose.
p
u
r
p
o
s
e
.
c
c
Method
M
e
t
h
o
d
1e
1
e
addressesthelimitation
a
d
d
r
e
s
s
e
s
t
h
e
l
i
m
i
t
a
t
i
o
n
of
o
f
the
t
h
e
external
e
x
t
e
r
n
a
l
coupling
c
o
u
p
l
i
n
g
of
o
f
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
¢
¢
Any
A
n
y
interrupts
i
n
t
e
r
r
u
p
t
s
used
u
s
e
d
haveto
h
a
v
e
t
o
bepriority-based.
b
e
p
r
i
o
r
i
t
y
-
b
a
s
e
d
.
NOTE
N
O
T
E
An
A
n
appropriate
a
p
p
r
o
p
r
i
a
t
e
compromise
c
o
m
p
r
o
m
i
s
e
between
b
e
t
w
e
e
n
the
t
h
e
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
3
3
can
c
a
n
be
b
e
necessary
n
e
c
e
s
s
a
r
y
since
s
i
n
c
e
the
t
h
e
methods
m
e
t
h
o
d
s
are
a
r
e
not
n
o
t
mutually
m
u
t
u
a
l
l
y
exclusive.
e
x
c
l
u
s
i
v
e
.
7.4.4
7
.
4
.
4
The
T
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
shall
s
h
a
l
l
be
b
e
developed
d
e
v
e
l
o
p
e
d
downto
d
o
w
n
t
o
the
t
h
e
level
l
e
v
e
l
whereall
w
h
e
r
e
a
l
l
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
are
a
r
e
identified.
i
d
e
n
t
i
f
i
e
d
.
7.4.5
7
.
4
.
5
The
T
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
shall
s
h
a
l
l
describe:
d
e
s
c
r
i
b
e
:
-
the
t
h
e
static
s
t
a
t
i
c
design
d
e
s
i
g
n
aspects
a
s
p
e
c
t
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
components;
c
o
m
p
o
n
e
n
t
s
;
and
a
n
d
NOTE
N
O
T
E
1
1
Static
S
t
a
t
i
c
design
d
e
s
i
g
n
aspects
a
s
p
e
c
t
s
address:
a
d
d
r
e
s
s
:
—_
—
_
the
t
h
e
softwarestructure
s
o
f
t
w
a
r
e
s
t
r
u
c
t
u
r
e
includingits
i
n
c
l
u
d
i
n
g
i
t
s
hierarchicallevels;
h
i
e
r
a
r
c
h
i
c
a
l
l
e
v
e
l
s
;
—
—
the
t
h
e
logical
l
o
g
i
c
a
l
sequence
s
e
q
u
e
n
c
e
of
o
f
data
d
a
t
a
processing;
p
r
o
c
e
s
s
i
n
g
;
—
—
the
t
h
e
data
d
a
t
a
types
t
y
p
e
s
andtheir
a
n
d
t
h
e
i
r
characteristics;
c
h
a
r
a
c
t
e
r
i
s
t
i
c
s
;
—
—
the
t
h
e
external
e
x
t
e
r
n
a
l
interfaces
i
n
t
e
r
f
a
c
e
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
components;
c
o
m
p
o
n
e
n
t
s
;
—
—
the
t
h
e
externalinterfaces
e
x
t
e
r
n
a
l
i
n
t
e
r
f
a
c
e
s
of
o
f
the
t
h
e
software;
s
o
f
t
w
a
r
e
;
and
a
n
d
—
—
the
t
h
e
constraints
c
o
n
s
t
r
a
i
n
t
s
including
i
n
c
l
u
d
i
n
g
the
t
h
e
scope
s
c
o
p
e
of
o
f
the
t
h
e
architecture
a
r
c
h
i
t
e
c
t
u
r
e
and
a
n
d
external
e
x
t
e
r
n
a
l
dependencies.
d
e
p
e
n
d
e
n
c
i
e
s
.
NOTE
N
O
T
E
2
2
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
modelling
m
o
d
e
l
l
i
n
g
the
t
h
e
structure
s
t
r
u
c
t
u
r
e
is
i
s
an
a
n
inherent
i
n
h
e
r
e
n
t
part
p
a
r
t
of
o
f
the
t
h
e
overall
o
v
e
r
a
l
l
modelling
m
o
d
e
l
l
i
n
g
activities.
a
c
t
i
v
i
t
i
e
s
.
-
the
t
h
e
dynamic
d
y
n
a
m
i
c
design
d
e
s
i
g
n
aspects
a
s
p
e
c
t
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
NOTE
N
O
T
E
1
1
Dynamic
D
y
n
a
m
i
c
design
d
e
s
i
g
n
aspects
a
s
p
e
c
t
s
address:
a
d
d
r
e
s
s
:
—
—
the
t
h
e
functionality
f
u
n
c
t
i
o
n
a
l
i
t
y
and
a
n
d
behaviour;
b
e
h
a
v
i
o
u
r
;
—
—
the
t
h
e
control
c
o
n
t
r
o
l
flow
f
l
o
w
and
a
n
d
concurrency
c
o
n
c
u
r
r
e
n
c
y
ofen
o
f
e
n
—
—
the
t
h
e
data
d
a
t
a
flow
f
l
o
w
between
b
e
t
w
e
e
n
the
t
h
e
software
s
o
f
t
w
a
r
e
components;
c
o
m
p
o
n
e
n
t
s
;
—
—
the
t
h
e
data
d
a
t
a
flow
f
l
o
w
at
a
t
external
e
x
t
e
r
n
a
l
interfaces;
i
n
t
e
r
f
a
c
e
s
;
and
a
n
d
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
—
—
the
t
h
e
temporalconstraints.
t
e
m
p
o
r
a
l
c
o
n
s
t
r
a
i
n
t
s
.
NOTE
N
O
T
E
2
2
To
T
o
determine
d
e
t
e
r
m
i
n
e
the
t
h
e
dynamic
d
y
n
a
m
i
c
behaviour
b
e
h
a
v
i
o
u
r
(e.g.
(
e
.
g
.
of
o
f
tasks,
t
a
s
k
s
,
time
t
i
m
e
slices
s
l
i
c
e
s
and
a
n
d
interrupts)
i
n
t
e
r
r
u
p
t
s
)
the
t
h
e
different
d
i
f
f
e
r
e
n
t
operating
o
p
e
r
a
t
i
n
g
states
s
t
a
t
e
s
(e.g.
(
e
.
g
.
power-up,
p
o
w
e
r
-
u
p
,
shut-down,
s
h
u
t
-
d
o
w
n
,
normal
n
o
r
m
a
l
operation,
o
p
e
r
a
t
i
o
n
,
calibration
c
a
l
i
b
r
a
t
i
o
n
and
a
n
d
diagnosis)
d
i
a
g
n
o
s
i
s
)
are
a
r
e
considered.
c
o
n
s
i
d
e
r
e
d
.
NOTE
N
O
T
E
3
3
To
T
o
describe
d
e
s
c
r
i
b
e
the
t
h
e
dynamic
d
y
n
a
m
i
c
behaviour
b
e
h
a
v
i
o
u
r
(e.g.
(
e
.
g
.
of
o
f
tasks,
t
a
s
k
s
,
time
t
i
m
e
slices
s
l
i
c
e
s
and
a
n
d
interrupts)
i
n
t
e
r
r
u
p
t
s
)
the
t
h
e
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
relationships
r
e
l
a
t
i
o
n
s
h
i
p
s
andtheir
a
n
d
t
h
e
i
r
allocation
a
l
l
o
c
a
t
i
o
n
to
t
o
the
t
h
e
system
s
y
s
t
e
m
hardware
h
a
r
d
w
a
r
e
(e.g.
(
e
.
g
.
CPU
C
P
U
and
a
n
d
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
channels)
c
h
a
n
n
e
l
s
)
are
a
r
e
specified.
s
p
e
c
i
f
i
e
d
.
7.4.6
7
.
4
.
6
Every
E
v
e
r
y
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
software
s
o
f
t
w
a
r
e
componentshall
c
o
m
p
o
n
e
n
t
s
h
a
l
l
be
b
e
categorized
c
a
t
e
g
o
r
i
z
e
d
as
a
s
oneofthe
o
n
e
o
f
t
h
e
following:
f
o
l
l
o
w
i
n
g
:
-
newly
n
e
w
l
y
developed;
d
e
v
e
l
o
p
e
d
;
-
reused
r
e
u
s
e
d
with
w
i
t
h
modifications;
m
o
d
i
f
i
c
a
t
i
o
n
s
;
or
o
r
Cc)
C
c
)
reused
r
e
u
s
e
d
without
w
i
t
h
o
u
t
modifications.
m
o
d
i
f
i
c
a
t
i
o
n
s
.
7.4.7
7
.
4
.
7
Safety-related
S
a
f
e
t
y
-
r
e
l
a
t
e
d
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
that
t
h
a
t
are
a
r
e
newly
n
e
w
l
y
developed
d
e
v
e
l
o
p
e
d
or
o
r
reused
r
e
u
s
e
d
with
w
i
t
h
modifications
m
o
d
i
f
i
c
a
t
i
o
n
s
shall
s
h
a
l
l
be
b
e
developedin
d
e
v
e
l
o
p
e
d
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262.
2
6
2
6
2
.
NOTE
N
O
T
E
In
I
n
these
t
h
e
s
e
cases
c
a
s
e
s
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
12,
1
2
,
does
d
o
e
s
not
n
o
t
apply.
a
p
p
l
y
.
7.4.8
7
.
4
.
8
Safety-related
S
a
f
e
t
y
-
r
e
l
a
t
e
d
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
that
t
h
a
t
are
a
r
e
reused
r
e
u
s
e
d
without
w
i
t
h
o
u
t
modifications
m
o
d
i
f
i
c
a
t
i
o
n
s
shall
s
h
a
l
l
be
b
e
qualified
q
u
a
l
i
f
i
e
d
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
12.
1
2
.
NOTE
N
O
T
E
The
T
h
e
use
u
s
e
of
o
f
qualified
q
u
a
l
i
f
i
e
d
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
does
d
o
e
s
not
n
o
t
affect
a
f
f
e
c
t
the
t
h
e
applicability
a
p
p
l
i
c
a
b
i
l
i
t
y
of
o
f
Clauses
C
l
a
u
s
e
s
10
1
0
and
a
n
d
11.
1
1
.
However,
H
o
w
e
v
e
r
,
someactivities
s
o
m
e
a
c
t
i
v
i
t
i
e
s
described
d
e
s
c
r
i
b
e
d
in
i
n
Clauses
C
l
a
u
s
e
s
8
8
and
a
n
d
9
9
can
c
a
n
be
b
e
omitted.
o
m
i
t
t
e
d
.
7.4.9
7
.
4
.
9
The
T
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
be
b
e
allocated
a
l
l
o
c
a
t
e
d
to
t
o
the
t
h
e
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
As
A
s
a
a
result,
r
e
s
u
l
t
,
each
e
a
c
h
software
s
o
f
t
w
a
r
e
component
c
o
m
p
o
n
e
n
t
shall
s
h
a
l
l
be
b
e
developed
d
e
v
e
l
o
p
e
d
in
i
n
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
highest
h
i
g
h
e
s
t
ASIL
A
S
I
L
of
o
f
any
a
n
y
of
o
f
the
t
h
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
allocatedto
a
l
l
o
c
a
t
e
d
t
o
it.
i
t
.
NOTE
N
O
T
E
Followingthis
F
o
l
l
o
w
i
n
g
t
h
i
s
allocation,
a
l
l
o
c
a
t
i
o
n
,
further
f
u
r
t
h
e
r
refinementof
r
e
f
i
n
e
m
e
n
t
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
can
c
a
n
be
b
e
necessary.
n
e
c
e
s
s
a
r
y
.
7.4.10
7
.
4
.
1
0
If
I
f
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
has
h
a
s
to
t
o
implement
i
m
p
l
e
m
e
n
t
software
s
o
f
t
w
a
r
e
componentsofdifferent
c
o
m
p
o
n
e
n
t
s
o
f
d
i
f
f
e
r
e
n
t
ASILs,
A
S
I
L
s
,
or
o
r
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
and
a
n
d
non-safety-related
n
o
n
-
s
a
f
e
t
y
-
r
e
l
a
t
e
d
software
s
o
f
t
w
a
r
e
components,
c
o
m
p
o
n
e
n
t
s
,
then
t
h
e
n
all
a
l
l
of
o
f
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
shall
s
h
a
l
l
be
b
e
treated
t
r
e
a
t
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
highest
h
i
g
h
e
s
t
ASIL,
A
S
I
L
,
unless
u
n
l
e
s
s
the
t
h
e
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
meet
m
e
e
t
the
t
h
e
criteria
c
r
i
t
e
r
i
a
for
f
o
r
coexistence
c
o
e
x
i
s
t
e
n
c
e
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Clause
C
l
a
u
s
e
6.
6
.
7.4.11
7
.
4
.
1
1
If
I
f
software
s
o
f
t
w
a
r
e
partitioning
p
a
r
t
i
t
i
o
n
i
n
g
(see
(
s
e
e
Annex
A
n
n
e
x
D)
D
)
is
i
s
used
u
s
e
d
to
t
o
implement
i
m
p
l
e
m
e
n
t
freedom
f
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
componentsit
c
o
m
p
o
n
e
n
t
s
i
t
shall
s
h
a
l
l
be
b
e
ensured
e
n
s
u
r
e
d
that:
t
h
a
t
:
-
the
t
h
e
shared
s
h
a
r
e
d
resources
r
e
s
o
u
r
c
e
s
are
a
r
e
used
u
s
e
d
in
i
n
such
s
u
c
h
a
a
way
w
a
y
that
t
h
a
t
freedom
f
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
of
o
f
software
s
o
f
t
w
a
r
e
partitions
p
a
r
t
i
t
i
o
n
s
is
i
s
ensured;
e
n
s
u
r
e
d
;
NOTE
N
O
T
E
1
1
Taskswithin
T
a
s
k
s
w
i
t
h
i
n
a
a
software
s
o
f
t
w
a
r
e
partition
p
a
r
t
i
t
i
o
n
are
a
r
e
not
n
o
t
free
f
r
e
e
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
among
a
m
o
n
g
eachother.
e
a
c
h
o
t
h
e
r
.
NOTE
N
O
T
E
2
2
One
O
n
e
software
s
o
f
t
w
a
r
e
partition
p
a
r
t
i
t
i
o
n
cannot
c
a
n
n
o
t
change
c
h
a
n
g
e
the
t
h
e
code
c
o
d
e
or
o
r
data
d
a
t
a
of
o
f
another
a
n
o
t
h
e
r
software
s
o
f
t
w
a
r
e
partition
p
a
r
t
i
t
i
o
n
nor
n
o
r
command
c
o
m
m
a
n
d
non-
n
o
n
-
shared
s
h
a
r
e
d
resourcesof
r
e
s
o
u
r
c
e
s
o
f
other
o
t
h
e
r
software
s
o
f
t
w
a
r
e
partitions.
p
a
r
t
i
t
i
o
n
s
.
NOTE
N
O
T
E
3
3
The
T
h
e
service
s
e
r
v
i
c
e
received
r
e
c
e
i
v
e
d
from
f
r
o
m
shared
s
h
a
r
e
d
resources
r
e
s
o
u
r
c
e
s
by
b
y
one
o
n
e
software
s
o
f
t
w
a
r
e
partition
p
a
r
t
i
t
i
o
n
cannot
c
a
n
n
o
t
be
b
e
affected
a
f
f
e
c
t
e
d
by
b
y
another
a
n
o
t
h
e
r
software
s
o
f
t
w
a
r
e
partition.
p
a
r
t
i
t
i
o
n
.
This
T
h
i
s
includes
i
n
c
l
u
d
e
s
the
t
h
e
performance
p
e
r
f
o
r
m
a
n
c
e
of
o
f
the
t
h
e
resources
r
e
s
o
u
r
c
e
s
concerned,as
c
o
n
c
e
r
n
e
d
,
a
s
well
w
e
l
l
as
a
s
the
t
h
e
rate,
r
a
t
e
,
latency,jitter
l
a
t
e
n
c
y
,
j
i
t
t
e
r
and
a
n
d
duration
d
u
r
a
t
i
o
n
of
o
f
scheduled
s
c
h
e
d
u
l
e
d
accessto
a
c
c
e
s
s
t
o
the
t
h
e
resource.
r
e
s
o
u
r
c
e
.
-
the
t
h
e
software
s
o
f
t
w
a
r
e
partitioning
p
a
r
t
i
t
i
o
n
i
n
g
is
i
s
supported
s
u
p
p
o
r
t
e
d
by
b
y
dedicated
d
e
d
i
c
a
t
e
d
hardware
h
a
r
d
w
a
r
e
features
f
e
a
t
u
r
e
s
or
o
r
equivalent
e
q
u
i
v
a
l
e
n
t
means(this
m
e
a
n
s
(
t
h
i
s
requirement
r
e
q
u
i
r
e
m
e
n
t
applies
a
p
p
l
i
e
s
to
t
o
ASIL
A
S
I
L
D,
D
,
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
4.3);
4
.
3
)
;
-
the
t
h
e
part
p
a
r
t
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
that
t
h
a
t
implements
i
m
p
l
e
m
e
n
t
s
the
t
h
e
software
s
o
f
t
w
a
r
e
partitioning
p
a
r
t
i
t
i
o
n
i
n
g
is
i
s
developed
d
e
v
e
l
o
p
e
d
in
i
n
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
same
s
a
m
e
or
o
r
an
a
n
ASIL
A
S
I
L
higher
h
i
g
h
e
r
than
t
h
a
n
the
t
h
e
highest
h
i
g
h
e
s
t
ASIL
A
S
I
L
assigned
a
s
s
i
g
n
e
d
to
t
o
the
t
h
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
partitions;
p
a
r
t
i
t
i
o
n
s
;
and
a
n
d
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
“ee
“
e
e
Le
L
e
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
NOTE
N
O
T
E
In
I
n
general
g
e
n
e
r
a
l
the
t
h
e
operating
o
p
e
r
a
t
i
n
g
system
s
y
s
t
e
m
provides
p
r
o
v
i
d
e
s
or
o
r
supports
s
u
p
p
o
r
t
s
software
s
o
f
t
w
a
r
e
partitioning.
p
a
r
t
i
t
i
o
n
i
n
g
.
-
the
t
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
partitioning
p
a
r
t
i
t
i
o
n
i
n
g
during
d
u
r
i
n
g
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing
t
e
s
t
i
n
g
(in
(
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
Clause
C
l
a
u
s
e
10)
1
0
)
is
i
s
performed.
p
e
r
f
o
r
m
e
d
.
7.4.12
7
.
4
.
1
2
An
A
n
analysis
a
n
a
l
y
s
i
s
of
o
f
dependentfailures
d
e
p
e
n
d
e
n
t
f
a
i
l
u
r
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Clause
C
l
a
u
s
e
7,
7
,
shall
s
h
a
l
l
be
b
e
carried
c
a
r
r
i
e
d
out
o
u
t
if
i
f
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
relies
r
e
l
i
e
s
on
o
n
freedom
f
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
or
o
r
sufficient
s
u
f
f
i
c
i
e
n
t
independence
i
n
d
e
p
e
n
d
e
n
c
e
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
7.4.13
7
.
4
.
1
3
Safety
S
a
f
e
t
y
analysis
a
n
a
l
y
s
i
s
shall
s
h
a
l
l
be
b
e
carried
c
a
r
r
i
e
d
out
o
u
t
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level
l
e
v
e
l
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Clause
C
l
a
u
s
e
8,
8
,
in
i
n
orderto:
o
r
d
e
r
t
o
:
—
—
identify
i
d
e
n
t
i
f
y
or
o
r
confirm
c
o
n
f
i
r
m
the
t
h
e
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
parts
p
a
r
t
s
of
o
f
the
t
h
e
software;
s
o
f
t
w
a
r
e
;
and
a
n
d
—
—
support
s
u
p
p
o
r
t
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
and
a
n
d
verify
v
e
r
i
f
y
the
t
h
e
efficiency
e
f
f
i
c
i
e
n
c
y
of
o
f
the
t
h
e
safety
s
a
f
e
t
y
mechanisms.
m
e
c
h
a
n
i
s
m
s
.
NOTE
N
O
T
E
Safety
S
a
f
e
t
y
mechanismscan
m
e
c
h
a
n
i
s
m
s
c
a
n
be
b
e
specified
s
p
e
c
i
f
i
e
d
to
t
o
cover
c
o
v
e
r
both
b
o
t
h
issues
i
s
s
u
e
s
associated
a
s
s
o
c
i
a
t
e
d
with
w
i
t
h
random
r
a
n
d
o
m
hardwarefailures
h
a
r
d
w
a
r
e
f
a
i
l
u
r
e
s
as
a
s
well
w
e
l
l
as
a
s
softwarefaults.
s
o
f
t
w
a
r
e
f
a
u
l
t
s
.
7.4.14
7
.
4
.
1
4
To
T
o
specify
s
p
e
c
i
f
y
the
t
h
e
necessary
n
e
c
e
s
s
a
r
y
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
mechanismsat
m
e
c
h
a
n
i
s
m
s
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level,
l
e
v
e
l
,
based
b
a
s
e
d
on
o
n
the
t
h
e
results
r
e
s
u
l
t
s
of
o
f
the
t
h
e
safety
s
a
f
e
t
y
analysis
a
n
a
l
y
s
i
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.4.13,
7
.
4
.
1
3
,
mechanisms
m
e
c
h
a
n
i
s
m
s
for
f
o
r
error
e
r
r
o
r
detection
d
e
t
e
c
t
i
o
n
aslisted
a
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
4
4
shall
s
h
a
l
l
be
b
e
applied.
a
p
p
l
i
e
d
.
NOTE
N
O
T
E
Whennotdirectly
W
h
e
n
n
o
t
d
i
r
e
c
t
l
y
required
r
e
q
u
i
r
e
d
by
b
y
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
allocated
a
l
l
o
c
a
t
e
d
to
t
o
software,
s
o
f
t
w
a
r
e
,
the
t
h
e
use
u
s
e
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
mechanismsis
m
e
c
h
a
n
i
s
m
s
i
s
reviewedat
r
e
v
i
e
w
e
d
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
to
t
o
analyse
a
n
a
l
y
s
e
the
t
h
e
potential
p
o
t
e
n
t
i
a
l
impact
i
m
p
a
c
t
on
o
n
the
t
h
e
system
s
y
s
t
e
m
behaviour.
b
e
h
a
v
i
o
u
r
.
Table
T
a
b
l
e
4
4
—
—
Mechanismsforerror
M
e
c
h
a
n
i
s
m
s
f
o
r
e
r
r
o
r
detection
d
e
t
e
c
t
i
o
n
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level
l
e
v
e
l
Methods
M
e
t
h
o
d
s
la
l
a
Range
R
a
n
g
e
checksof
c
h
e
c
k
s
o
f
input
i
n
p
u
t
and
a
n
d
output
o
u
t
p
u
t
data
d
a
t
a
1b
1
b
Plausibility
P
l
a
u
s
i
b
i
l
i
t
y
check?
c
h
e
c
k
?
1c
1
c
|
|
1d
1
d
Detection
D
e
t
e
c
t
i
o
n
of
o
f
data
d
a
t
a
errors?
e
r
r
o
r
s
?
External
E
x
t
e
r
n
a
l
monitoring
m
o
n
i
t
o
r
i
n
g
facility©
f
a
c
i
l
i
t
y
©
1e
1
e
|
|
Control
C
o
n
t
r
o
l
flow
f
l
o
w
monitoring
m
o
n
i
t
o
r
i
n
g
|
|
Oo
O
o
|
|
1f
1
f
aber
a
b
e
r
Diverse
D
i
v
e
r
s
e
software
s
o
f
t
w
a
r
e
design
d
e
s
i
g
n
4
4
Plausibility
P
l
a
u
s
i
b
i
l
i
t
y
checks
c
h
e
c
k
s
can
c
a
n
include
i
n
c
l
u
d
e
using
u
s
i
n
g
a
a
reference
r
e
f
e
r
e
n
c
e
model
m
o
d
e
l
of
o
f
the
t
h
e
desired
d
e
s
i
r
e
d
behaviour,
b
e
h
a
v
i
o
u
r
,
assertion
a
s
s
e
r
t
i
o
n
checks,
c
h
e
c
k
s
,
or
o
r
comparing
c
o
m
p
a
r
i
n
g
signals
s
i
g
n
a
l
s
from
f
r
o
m
different
d
i
f
f
e
r
e
n
t
sources.
s
o
u
r
c
e
s
.
b
b
Types
T
y
p
e
s
of
o
f
methods
m
e
t
h
o
d
s
that
t
h
a
t
may
m
a
y
be
b
e
usedto
u
s
e
d
t
o
detect
d
e
t
e
c
t
data
d
a
t
a
errors
e
r
r
o
r
s
include
i
n
c
l
u
d
e
error
e
r
r
o
r
detecting
d
e
t
e
c
t
i
n
g
codes
c
o
d
e
s
and
a
n
d
multiple
m
u
l
t
i
p
l
e
data
d
a
t
a
storage.
s
t
o
r
a
g
e
.
¢
¢
Anexternal
A
n
e
x
t
e
r
n
a
l
monitoring
m
o
n
i
t
o
r
i
n
g
facility
f
a
c
i
l
i
t
y
can
c
a
n
be,
b
e
,
for
f
o
r
example,
e
x
a
m
p
l
e
,
an
a
n
ASIC
A
S
I
C
or
o
r
another
a
n
o
t
h
e
r
software
s
o
f
t
w
a
r
e
element
e
l
e
m
e
n
t
performing
p
e
r
f
o
r
m
i
n
g
a
a
watchdogfunction.
w
a
t
c
h
d
o
g
f
u
n
c
t
i
o
n
.
7.4.15
7
.
4
.
1
5
This
T
h
i
s
subclause
s
u
b
c
l
a
u
s
e
applies
a
p
p
l
i
e
s
to
t
o
ASIL
A
S
I
L
(A),
(
A
)
,
(B),
(
B
)
,
C
C
and
a
n
d
D,
D
,
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
4.3:
4
.
3
:
to
t
o
specify
s
p
e
c
i
f
y
the
t
h
e
necessary
n
e
c
e
s
s
a
r
y
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
mechanismsat
m
e
c
h
a
n
i
s
m
s
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level,
l
e
v
e
l
,
based
b
a
s
e
d
on
o
n
the
t
h
e
results
r
e
s
u
l
t
s
of
o
f
the
t
h
e
safety
s
a
f
e
t
y
analysis
a
n
a
l
y
s
i
s
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
7.4.13,
7
.
4
.
1
3
,
mechanismsfor
m
e
c
h
a
n
i
s
m
s
f
o
r
error
e
r
r
o
r
handling
h
a
n
d
l
i
n
g
aslisted
a
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
5
5
shall
s
h
a
l
l
be
b
e
applied.
a
p
p
l
i
e
d
.
NOTE
N
O
T
E
1
1
Whennotdirectly
W
h
e
n
n
o
t
d
i
r
e
c
t
l
y
required
r
e
q
u
i
r
e
d
by
b
y
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
allocated
a
l
l
o
c
a
t
e
d
to
t
o
software,
s
o
f
t
w
a
r
e
,
the
t
h
e
use
u
s
e
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
mechanismsis
m
e
c
h
a
n
i
s
m
s
i
s
reviewed
r
e
v
i
e
w
e
d
at
a
t
the
t
h
e
system
s
y
s
t
e
m
level
l
e
v
e
l
to
t
o
analyse
a
n
a
l
y
s
e
the
t
h
e
potential
p
o
t
e
n
t
i
a
l
impact
i
m
p
a
c
t
on
o
n
the
t
h
e
system
s
y
s
t
e
m
behaviour.
b
e
h
a
v
i
o
u
r
.
NOTE2
N
O
T
E
2
The
T
h
e
analysis
a
n
a
l
y
s
i
s
at
a
t
software
s
o
f
t
w
a
r
e
architecturallevel
a
r
c
h
i
t
e
c
t
u
r
a
l
l
e
v
e
l
of
o
f
possible
p
o
s
s
i
b
l
e
hazards
h
a
z
a
r
d
s
due
d
u
e
to
t
o
hardware
h
a
r
d
w
a
r
e
is
i
s
described
d
e
s
c
r
i
b
e
d
in
i
n
ISO
I
S
O
26262-5.
2
6
2
6
2
-
5
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Table
T
a
b
l
e
5
5
—
—
Mechanismsforerror
M
e
c
h
a
n
i
s
m
s
f
o
r
e
r
r
o
r
handling
h
a
n
d
l
i
n
g
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level
l
e
v
e
l
Methods
M
e
t
h
o
d
s
Static
S
t
a
t
i
c
recovery
r
e
c
o
v
e
r
y
mechanism#
m
e
c
h
a
n
i
s
m
#
Graceful
G
r
a
c
e
f
u
l
degradation®
d
e
g
r
a
d
a
t
i
o
n
®
Independentparallel
I
n
d
e
p
e
n
d
e
n
t
p
a
r
a
l
l
e
l
redundancy®
r
e
d
u
n
d
a
n
c
y
®
Correcting
C
o
r
r
e
c
t
i
n
g
codesfor
c
o
d
e
s
f
o
r
data
d
a
t
a
#
#
Static
S
t
a
t
i
c
recovery
r
e
c
o
v
e
r
y
mechanisms
m
e
c
h
a
n
i
s
m
s
can
c
a
n
include
i
n
c
l
u
d
e
the
t
h
e
use
u
s
e
of
o
f
recovery
r
e
c
o
v
e
r
y
blocks,
b
l
o
c
k
s
,
backward
b
a
c
k
w
a
r
d
recovery,
r
e
c
o
v
e
r
y
,
forward
f
o
r
w
a
r
d
recovery
r
e
c
o
v
e
r
y
and
a
n
d
recovery
r
e
c
o
v
e
r
y
through
t
h
r
o
u
g
h
repetition.
r
e
p
e
t
i
t
i
o
n
.
5
5
Graceful
G
r
a
c
e
f
u
l
degradation
d
e
g
r
a
d
a
t
i
o
n
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
refers
r
e
f
e
r
s
to
t
o
prioritizing
p
r
i
o
r
i
t
i
z
i
n
g
functions
f
u
n
c
t
i
o
n
s
to
t
o
minimize
m
i
n
i
m
i
z
e
the
t
h
e
adverse
a
d
v
e
r
s
e
effects
e
f
f
e
c
t
s
of
o
f
potential
p
o
t
e
n
t
i
a
l
failures
f
a
i
l
u
r
e
s
on
o
n
functional
f
u
n
c
t
i
o
n
a
l
safety.
s
a
f
e
t
y
.
c
c
Independent
I
n
d
e
p
e
n
d
e
n
t
parallel
p
a
r
a
l
l
e
l
redundancycan
r
e
d
u
n
d
a
n
c
y
c
a
n
berealized
b
e
r
e
a
l
i
z
e
d
as
a
s
dissimilar
d
i
s
s
i
m
i
l
a
r
software
s
o
f
t
w
a
r
e
in
i
n
each
e
a
c
h
parallel
p
a
r
a
l
l
e
l
path.
p
a
t
h
.
7.4.16
7
.
4
.
1
6
If
I
f
new
n
e
w
hazards
h
a
z
a
r
d
s
introduced
i
n
t
r
o
d
u
c
e
d
by
b
y
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
are
a
r
e
not
n
o
t
already
a
l
r
e
a
d
y
covered
c
o
v
e
r
e
d
by
b
y
an
a
n
existing
e
x
i
s
t
i
n
g
safety
s
a
f
e
t
y
goal,
g
o
a
l
,
they
t
h
e
y
shall
s
h
a
l
l
be
b
e
introduced
i
n
t
r
o
d
u
c
e
d
and
a
n
d
evaluated
e
v
a
l
u
a
t
e
d
in
i
n
the
t
h
e
hazard
h
a
z
a
r
d
analysis
a
n
a
l
y
s
i
s
and
a
n
d
risk
r
i
s
k
assessmentin
a
s
s
e
s
s
m
e
n
t
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
change
c
h
a
n
g
e
managementprocessin
m
a
n
a
g
e
m
e
n
t
p
r
o
c
e
s
s
i
n
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
8.
8
.
NOTE
N
O
T
E
Newly
N
e
w
l
y
identified
i
d
e
n
t
i
f
i
e
d
hazards,
h
a
z
a
r
d
s
,
not
n
o
t
already
a
l
r
e
a
d
y
reflected
r
e
f
l
e
c
t
e
d
in
i
n
a
a
safety
s
a
f
e
t
y
goal,
g
o
a
l
,
are
a
r
e
usually
u
s
u
a
l
l
y
non-functional
n
o
n
-
f
u
n
c
t
i
o
n
a
l
hazards.
h
a
z
a
r
d
s
.
If
I
f
those
t
h
o
s
e
non-functional
n
o
n
-
f
u
n
c
t
i
o
n
a
l
hazards
h
a
z
a
r
d
s
are
a
r
e
outside
o
u
t
s
i
d
e
the
t
h
e
scopeof
s
c
o
p
e
o
f
this
t
h
i
s
standard
s
t
a
n
d
a
r
d
thenit
t
h
e
n
i
t
is
i
s
recommended
r
e
c
o
m
m
e
n
d
e
d
that
t
h
a
t
they
t
h
e
y
be
b
e
annotated
a
n
n
o
t
a
t
e
d
in
i
n
the
t
h
e
hazard
h
a
z
a
r
d
analysis
a
n
a
l
y
s
i
s
and
a
n
d
risk
r
i
s
k
assessmentwith
a
s
s
e
s
s
m
e
n
t
w
i
t
h
the
t
h
e
following
f
o
l
l
o
w
i
n
g
statement
s
t
a
t
e
m
e
n
t
“No
“
N
o
ASIL
A
S
I
L
is
i
s
assigned
a
s
s
i
g
n
e
d
to
t
o
this
t
h
i
s
hazard
h
a
z
a
r
d
asit
a
s
i
t
is
i
s
not
n
o
t
within
w
i
t
h
i
n
the
t
h
e
scope
s
c
o
p
e
of
o
f
ISO
I
S
O
26262.”
2
6
2
6
2
.
”
However,
H
o
w
e
v
e
r
,
an
a
n
ASILis
A
S
I
L
i
s
allowed
a
l
l
o
w
e
d
for
f
o
r
reference
r
e
f
e
r
e
n
c
e
purposes.
p
u
r
p
o
s
e
s
.
7.4.17
7
.
4
.
1
7
An
A
n
upperestimation
u
p
p
e
r
e
s
t
i
m
a
t
i
o
n
of
o
f
required
r
e
q
u
i
r
e
d
resources
r
e
s
o
u
r
c
e
s
for
f
o
r
the
t
h
e
embeddedsoftware
e
m
b
e
d
d
e
d
s
o
f
t
w
a
r
e
shall
s
h
a
l
l
be
b
e
made,including:
m
a
d
e
,
i
n
c
l
u
d
i
n
g
:
-
the
t
h
e
execution
e
x
e
c
u
t
i
o
n
time;
t
i
m
e
;
-
the
t
h
e
storage
s
t
o
r
a
g
e
space;
s
p
a
c
e
;
and
a
n
d
EXAMPLE
E
X
A
M
P
L
E
RAMfor
R
A
M
f
o
r
stacks
s
t
a
c
k
s
and
a
n
d
heaps,
h
e
a
p
s
,
ROM
R
O
M
for
f
o
r
program
p
r
o
g
r
a
m
and
a
n
d
non-volatile
n
o
n
-
v
o
l
a
t
i
l
e
data.
d
a
t
a
.
-
the
t
h
e
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
resources.
r
e
s
o
u
r
c
e
s
.
!
!
7.4.18
7
.
4
.
1
8
The
T
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
shall
s
h
a
l
l
be
b
e
verified
v
e
r
i
f
i
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9,
9
,
and
a
n
d
by
b
y
using
u
s
i
n
g
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
verification
v
e
r
i
f
i
c
a
t
i
o
n
methods
m
e
t
h
o
d
s
listed
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
6
6
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
the
t
h
e
following
f
o
l
l
o
w
i
n
g
properties:
p
r
o
p
e
r
t
i
e
s
:
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements;
r
e
q
u
i
r
e
m
e
n
t
s
;
-
compatibility
c
o
m
p
a
t
i
b
i
l
i
t
y
with
w
i
t
h
the
t
h
e
target
t
a
r
g
e
t
hardware;
h
a
r
d
w
a
r
e
;
and
a
n
d
NOTE
N
O
T
E
This
T
h
i
s
includes
i
n
c
l
u
d
e
s
the
t
h
e
resources
r
e
s
o
u
r
c
e
s
as
a
s
specified
s
p
e
c
i
f
i
e
d
in
i
n
7.4.17.
7
.
4
.
1
7
.
-
adherenceto
a
d
h
e
r
e
n
c
e
t
o
design
d
e
s
i
g
n
guidelines.
g
u
i
d
e
l
i
n
e
s
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Table
T
a
b
l
e
6
6
—
—
Methodsforthe
M
e
t
h
o
d
s
f
o
r
t
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
Methods
M
e
t
h
o
d
s
Walk-through
W
a
l
k
-
t
h
r
o
u
g
h
of
o
f
the
t
h
e
design@
d
e
s
i
g
n
@
Inspection
I
n
s
p
e
c
t
i
o
n
of
o
f
the
t
h
e
design?
d
e
s
i
g
n
?
Simulation
S
i
m
u
l
a
t
i
o
n
of
o
f
dynamicparts
d
y
n
a
m
i
c
p
a
r
t
s
of
o
f
the
t
h
e
design®
d
e
s
i
g
n
®
++
+
+
+
+
+
+
|
|
Prototype
P
r
o
t
o
t
y
p
e
generation
g
e
n
e
r
a
t
i
o
n
oO
o
O
|
|
Formalverification
F
o
r
m
a
l
v
e
r
i
f
i
c
a
t
i
o
n
1
1
|
|
Control
C
o
n
t
r
o
l
flow
f
l
o
w
analysis®
a
n
a
l
y
s
i
s
®
|
|
oO
o
O
Data
D
a
t
a
flow
f
l
o
w
analysis®
a
n
a
l
y
s
i
s
®
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
these
t
h
e
s
e
methods
m
e
t
h
o
d
s
can
c
a
n
be
b
e
applied
a
p
p
l
i
e
d
to
t
o
the
t
h
e
model.
m
o
d
e
l
.
Method
M
e
t
h
o
d
1c
1
c
requires
r
e
q
u
i
r
e
s
the
t
h
e
usage
u
s
a
g
e
of
o
f
executable
e
x
e
c
u
t
a
b
l
e
models
m
o
d
e
l
s
for
f
o
r
the
t
h
e
dynamic
d
y
n
a
m
i
c
parts
p
a
r
t
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
architecture.
a
r
c
h
i
t
e
c
t
u
r
e
.
Control
C
o
n
t
r
o
l
and
a
n
d
dataflow
d
a
t
a
f
l
o
w
analysis
a
n
a
l
y
s
i
s
may
m
a
y
belimited
b
e
l
i
m
i
t
e
d
to
t
o
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
componentsandtheir
c
o
m
p
o
n
e
n
t
s
a
n
d
t
h
e
i
r
interfaces.
i
n
t
e
r
f
a
c
e
s
.
7.5
7
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
7.5.1
7
.
5
.
1
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
7.4.1
7
.
4
.
1
to
t
o
7.4.6,
7
.
4
.
6
,
7.4.9,
7
.
4
.
9
,
7.4.10,
7
.
4
.
1
0
,
7.4.14,
7
.
4
.
1
4
,
7.4.15
7
.
4
.
1
5
and
a
n
d
7.4.17.
7
.
4
.
1
7
.
7.5.2
7
.
5
.
2
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
7.4.7.
7
.
4
.
7
.
7.5.3
7
.
5
.
3
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
7.4.9.
7
.
4
.
9
.
7.5.4
7
.
5
.
4
Safety
S
a
f
e
t
y
analysis
a
n
a
l
y
s
i
s
report
r
e
p
o
r
t
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
7.4.13.
7
.
4
.
1
3
.
7.5.5
7
.
5
.
5
Dependentfailures
D
e
p
e
n
d
e
n
t
f
a
i
l
u
r
e
s
analysis
a
n
a
l
y
s
i
s
report
r
e
p
o
r
t
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
7.4.12.
7
.
4
.
1
2
.
7.5.6
7
.
5
.
6
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
7.4.18.
7
.
4
.
1
8
.
8
8
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
8.1
8
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
first
f
i
r
s
t
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
is
i
s
to
t
o
specify
s
p
e
c
i
f
y
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
and
a
n
d
the
t
h
e
associated
a
s
s
o
c
i
a
t
e
d
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
The
T
h
e
second
s
e
c
o
n
d
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phaseis
s
u
b
-
p
h
a
s
e
i
s
to
t
o
implement
i
m
p
l
e
m
e
n
t
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
as
a
s
specified.
s
p
e
c
i
f
i
e
d
.
The
T
h
e
third
t
h
i
r
d
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phaseis
s
u
b
-
p
h
a
s
e
i
s
the
t
h
e
static
s
t
a
t
i
c
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
design
d
e
s
i
g
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
and
a
n
d
their
t
h
e
i
r
implementation.
i
m
p
l
e
m
e
n
t
a
t
i
o
n
.
8.2
8
.
2
General
G
e
n
e
r
a
l
Based
B
a
s
e
d
on
o
n
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design,
d
e
s
i
g
n
,
the
t
h
e
detailed
d
e
t
a
i
l
e
d
design
d
e
s
i
g
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
is
i
s
developed.
d
e
v
e
l
o
p
e
d
.
The
T
h
e
detailed
d
e
t
a
i
l
e
d
design
d
e
s
i
g
n
will
w
i
l
l
be
b
e
implemented
i
m
p
l
e
m
e
n
t
e
d
as
a
s
a
a
model
m
o
d
e
l
or
o
r
directly
d
i
r
e
c
t
l
y
as
a
s
source
s
o
u
r
c
e
code,
c
o
d
e
,
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
modelling
m
o
d
e
l
l
i
n
g
or
o
r
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
respectively.
r
e
s
p
e
c
t
i
v
e
l
y
.
The
T
h
e
detailed
d
e
t
a
i
l
e
d
design
d
e
s
i
g
n
and
a
n
d
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
are
a
r
e
statically
s
t
a
t
i
c
a
l
l
y
verified
v
e
r
i
f
i
e
d
before
b
e
f
o
r
e
proceeding
p
r
o
c
e
e
d
i
n
g
to
t
o
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
phase.
p
h
a
s
e
.
The
T
h
e
implementation-related
i
m
p
l
e
m
e
n
t
a
t
i
o
n
-
r
e
l
a
t
e
d
properties
p
r
o
p
e
r
t
i
e
s
are
a
r
e
achievable
a
c
h
i
e
v
a
b
l
e
at
a
t
the
t
h
e
source
s
o
u
r
c
e
code
c
o
d
e
level
l
e
v
e
l
if
i
f
manual
m
a
n
u
a
l
code
c
o
d
e
development
d
e
v
e
l
o
p
m
e
n
t
is
i
s
used.
u
s
e
d
.
If
I
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
with
w
i
t
h
automatic
a
u
t
o
m
a
t
i
c
code
c
o
d
e
generation
g
e
n
e
r
a
t
i
o
n
is
i
s
used,
u
s
e
d
,
these
t
h
e
s
e
properties
p
r
o
p
e
r
t
i
e
s
apply
a
p
p
l
y
to
t
o
the
t
h
e
model
m
o
d
e
l
and
a
n
d
need
n
e
e
d
notapply
n
o
t
a
p
p
l
y
to
t
o
the
t
h
e
source
s
o
u
r
c
e
code.
c
o
d
e
.
In
I
n
order
o
r
d
e
r
to
t
o
develop
d
e
v
e
l
o
p
a
a
single
s
i
n
g
l
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
both
b
o
t
h
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
as
a
s
well
w
e
l
l
as
a
s
all
a
l
l
non-safety-
n
o
n
-
s
a
f
e
t
y
-
related
r
e
l
a
t
e
d
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
implemented.
i
m
p
l
e
m
e
n
t
e
d
.
Hence
H
e
n
c
e
in
i
n
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
and
a
n
d
non-safety-related
n
o
n
-
s
a
f
e
t
y
-
r
e
l
a
t
e
d
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
handled
h
a
n
d
l
e
d
within
w
i
t
h
i
n
one
o
n
e
developmentprocess.
d
e
v
e
l
o
p
m
e
n
t
p
r
o
c
e
s
s
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
The
T
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
includes
i
n
c
l
u
d
e
s
the
t
h
e
generation
g
e
n
e
r
a
t
i
o
n
of
o
f
source
s
o
u
r
c
e
code
c
o
d
e
and
a
n
d
the
t
h
e
translation
t
r
a
n
s
l
a
t
i
o
n
into
i
n
t
o
object
o
b
j
e
c
t
code.
c
o
d
e
.
8.3
8
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
8.3.1
8
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
design
d
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
languagesin
l
a
n
g
u
a
g
e
s
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.3;
5
.
5
.
3
;
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
6.5.3:
6
.
5
.
3
:
—
—
softwarearchitectural
s
o
f
t
w
a
r
e
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.1:
7
.
5
.
1
:
—
—
safety
s
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.2:
7
.
5
.
2
:
—
—
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.3;
7
.
5
.
3
;
and
a
n
d
—
—
software
s
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.6.
7
.
5
.
6
.
8.3.2
8
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.1);
7
.
5
.
1
)
;
—
—
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.2):
7
.
5
.
2
)
:
—
—
tool
t
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.4:
5
.
5
.
4
:
—
—
_hardware-softwareinterface
_
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
6.5.2);
6
.
5
.
2
)
;
—
—
safety
s
a
f
e
t
y
analysis
a
n
a
l
y
s
i
s
report
r
e
p
o
r
t
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.4;
7
.
5
.
4
;
and
a
n
d
—
—
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
8.4
8
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
8.4.1
8
.
4
.
1
The
T
h
e
requirementsof
r
e
q
u
i
r
e
m
e
n
t
s
o
f
this
t
h
i
s
subclause
s
u
b
c
l
a
u
s
e
shall
s
h
a
l
l
be
b
e
complied
c
o
m
p
l
i
e
d
with
w
i
t
h
if
i
f
the
t
h
e
softwareunit
s
o
f
t
w
a
r
e
u
n
i
t
is
i
s
safety-related.
s
a
f
e
t
y
-
r
e
l
a
t
e
d
.
NOTE
N
O
T
E
“Safety-related”
“
S
a
f
e
t
y
-
r
e
l
a
t
e
d
”
meansthat
m
e
a
n
s
t
h
a
t
the
t
h
e
unit
u
n
i
t
implements
i
m
p
l
e
m
e
n
t
s
safety
s
a
f
e
t
y
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
or
o
r
that
t
h
a
t
the
t
h
e
criteria
c
r
i
t
e
r
i
a
for
f
o
r
coexistence
c
o
e
x
i
s
t
e
n
c
e
(see
(
s
e
e
ISO
I
S
O
26262-9:2011,
2
6
2
6
2
-
9
:
2
0
1
1
,
Ciause
C
i
a
u
s
e
6)
6
)
of
o
f
the
t
h
e
unit
u
n
i
t
with
w
i
t
h
other
o
t
h
e
r
units
u
n
i
t
s
are
a
r
e
not
n
o
t
satisfied.
s
a
t
i
s
f
i
e
d
.
8.4.2
8
.
4
.
2
To
T
o
ensure
e
n
s
u
r
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
captures
c
a
p
t
u
r
e
s
the
t
h
e
information
i
n
f
o
r
m
a
t
i
o
n
necessary
n
e
c
e
s
s
a
r
y
to
t
o
allow
a
l
l
o
w
the
t
h
e
subsequent
s
u
b
s
e
q
u
e
n
t
developmentactivities
d
e
v
e
l
o
p
m
e
n
t
a
c
t
i
v
i
t
i
e
s
to
t
o
be
b
e
performed
p
e
r
f
o
r
m
e
d
correctly
c
o
r
r
e
c
t
l
y
and
a
n
d
effectively,
e
f
f
e
c
t
i
v
e
l
y
,
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
shall
s
h
a
l
l
be
b
e
described
d
e
s
c
r
i
b
e
d
using
u
s
i
n
g
the
t
h
e
notationslisted
n
o
t
a
t
i
o
n
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
7.
7
.
Table
T
a
b
l
e
7
7
—
—
Notations
N
o
t
a
t
i
o
n
s
for
f
o
r
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
Natural
N
a
t
u
r
a
l
language
l
a
n
g
u
a
g
e
1b
1
b
Informal
I
n
f
o
r
m
a
l
notations
n
o
t
a
t
i
o
n
s
Semi-formal
S
e
m
i
-
f
o
r
m
a
l
notations
n
o
t
a
t
i
o
n
s
Formal
F
o
r
m
a
l
notations
n
o
t
a
t
i
o
n
s
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
NOTE
N
O
T
E
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
with
w
i
t
h
automatic
a
u
t
o
m
a
t
i
c
code
c
o
d
e
generation,
g
e
n
e
r
a
t
i
o
n
,
the
t
h
e
methods
m
e
t
h
o
d
s
for
f
o
r
representing
r
e
p
r
e
s
e
n
t
i
n
g
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
are
a
r
e
applied
a
p
p
l
i
e
d
to
t
o
the
t
h
e
model
m
o
d
e
l
which
w
h
i
c
h
servesasthe
s
e
r
v
e
s
a
s
t
h
e
basis
b
a
s
i
s
for
f
o
r
the
t
h
e
code
c
o
d
e
generation.
g
e
n
e
r
a
t
i
o
n
.
8.4.3.
8
.
4
.
3
.
The
T
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
shall
s
h
a
l
l
describe
d
e
s
c
r
i
b
e
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
behaviour
b
e
h
a
v
i
o
u
r
and
a
n
d
the
t
h
e
internal
i
n
t
e
r
n
a
l
design
d
e
s
i
g
n
to
t
o
the
t
h
e
level
l
e
v
e
l
of
o
f
detail
d
e
t
a
i
l
necessary
n
e
c
e
s
s
a
r
y
for
f
o
r
their
t
h
e
i
r
implementation.
i
m
p
l
e
m
e
n
t
a
t
i
o
n
.
EXAMPLE
E
X
A
M
P
L
E
Internal
I
n
t
e
r
n
a
l
design
d
e
s
i
g
n
can
c
a
n
include
i
n
c
l
u
d
e
constraints
c
o
n
s
t
r
a
i
n
t
s
on
o
n
the
t
h
e
use
u
s
e
of
o
f
registers
r
e
g
i
s
t
e
r
s
and
a
n
d
storageof
s
t
o
r
a
g
e
o
f
data.
d
a
t
a
.
8.4.4
8
.
4
.
4
Design
D
e
s
i
g
n
principles
p
r
i
n
c
i
p
l
e
s
for
f
o
r
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
at
a
t
the
t
h
e
source
s
o
u
r
c
e
code
c
o
d
e
level
l
e
v
e
l
as
a
s
listed
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
8
8
shall
s
h
a
l
l
be
b
e
applied
a
p
p
l
i
e
d
to
t
o
achieve
a
c
h
i
e
v
e
the
t
h
e
following
f
o
l
l
o
w
i
n
g
properties:
p
r
o
p
e
r
t
i
e
s
:
-
correct
c
o
r
r
e
c
t
order
o
r
d
e
r
of
o
f
execution
e
x
e
c
u
t
i
o
n
of
o
f
subprograms
s
u
b
p
r
o
g
r
a
m
s
and
a
n
d
functions
f
u
n
c
t
i
o
n
s
within
w
i
t
h
i
n
the
t
h
e
software
s
o
f
t
w
a
r
e
units,
u
n
i
t
s
,
based
b
a
s
e
d
on
o
n
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design;
d
e
s
i
g
n
;
consistency
c
o
n
s
i
s
t
e
n
c
y
of
o
f
the
t
h
e
interfaces
i
n
t
e
r
f
a
c
e
s
between
b
e
t
w
e
e
n
the
t
h
e
software
s
o
f
t
w
a
r
e
units;
u
n
i
t
s
;
correctnessof
c
o
r
r
e
c
t
n
e
s
s
o
f
data
d
a
t
a
flow
f
l
o
w
and
a
n
d
control
c
o
n
t
r
o
l
flow
f
l
o
w
between
b
e
t
w
e
e
n
andwithin
a
n
d
w
i
t
h
i
n
the
t
h
e
software
s
o
f
t
w
a
r
e
units;
u
n
i
t
s
;
simplicity;
s
i
m
p
l
i
c
i
t
y
;
readability
r
e
a
d
a
b
i
l
i
t
y
and
a
n
d
comprehensibility;
c
o
m
p
r
e
h
e
n
s
i
b
i
l
i
t
y
;
robustness;
r
o
b
u
s
t
n
e
s
s
;
EXAMPLE
E
X
A
M
P
L
E
Methodsto
M
e
t
h
o
d
s
t
o
prevent
p
r
e
v
e
n
t
implausible
i
m
p
l
a
u
s
i
b
l
e
values,
v
a
l
u
e
s
,
execution
e
x
e
c
u
t
i
o
n
errors,
e
r
r
o
r
s
,
division
d
i
v
i
s
i
o
n
by
b
y
zero,
z
e
r
o
,
and
a
n
d
errors
e
r
r
o
r
s
in
i
n
the
t
h
e
data
d
a
t
a
flow
f
l
o
w
and
a
n
d
controlflow.
c
o
n
t
r
o
l
f
l
o
w
.
suitability
s
u
i
t
a
b
i
l
i
t
y
for
f
o
r
software
s
o
f
t
w
a
r
e
modification;
m
o
d
i
f
i
c
a
t
i
o
n
;
and
a
n
d
testability.
t
e
s
t
a
b
i
l
i
t
y
.
Table
T
a
b
l
e
8
8
—
—
Design
D
e
s
i
g
n
principles
p
r
i
n
c
i
p
l
e
s
for
f
o
r
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
Methods
M
e
t
h
o
d
s
Oneentry
O
n
e
e
n
t
r
y
and
a
n
d
oneexit
o
n
e
e
x
i
t
point
p
o
i
n
t
in
i
n
subprograms
s
u
b
p
r
o
g
r
a
m
s
and
a
n
d
functions#
f
u
n
c
t
i
o
n
s
#
No
N
o
dynamic
d
y
n
a
m
i
c
objects
o
b
j
e
c
t
s
or
o
r
variables,
v
a
r
i
a
b
l
e
s
,
or
o
r
else
e
l
s
e
online
o
n
l
i
n
e
test
t
e
s
t
during
d
u
r
i
n
g
their
t
h
e
i
r
creation#.>
c
r
e
a
t
i
o
n
#
.
>
Initialization
I
n
i
t
i
a
l
i
z
a
t
i
o
n
of
o
f
variables
v
a
r
i
a
b
l
e
s
No
N
o
multiple
m
u
l
t
i
p
l
e
use
u
s
e
of
o
f
variable
v
a
r
i
a
b
l
e
names?
n
a
m
e
s
?
Avoid
A
v
o
i
d
global
g
l
o
b
a
l
variablesor
v
a
r
i
a
b
l
e
s
o
r
elsejustify
e
l
s
e
j
u
s
t
i
f
y
their
t
h
e
i
r
usage®
u
s
a
g
e
®
Limited
L
i
m
i
t
e
d
use
u
s
e
of
o
f
pointers
p
o
i
n
t
e
r
s
No
N
o
implicit
i
m
p
l
i
c
i
t
type
t
y
p
e
conversions?
c
o
n
v
e
r
s
i
o
n
s
?
No
N
o
hidden
h
i
d
d
e
n
data
d
a
t
a
flow
f
l
o
w
or
o
r
control
c
o
n
t
r
o
l
flow”
f
l
o
w
”
No
N
o
unconditional
u
n
c
o
n
d
i
t
i
o
n
a
l
jumps#:>.°
j
u
m
p
s
#
:
>
.
°
|
|
No
N
o
recursions
r
e
c
u
r
s
i
o
n
s
Methods1a,
M
e
t
h
o
d
s
1
a
,
1b,
1
b
,
1d,
1
d
,
1e,
1
e
,
1f,
1
f
,
1g
1
g
and
a
n
d
1i
1
i
may
m
a
y
not
n
o
t
be
b
e
applicable
a
p
p
l
i
c
a
b
l
e
for
f
o
r
graphical
g
r
a
p
h
i
c
a
l
modelling
m
o
d
e
l
l
i
n
g
notations
n
o
t
a
t
i
o
n
s
used
u
s
e
d
in
i
n
model-based
m
o
d
e
l
-
b
a
s
e
d
development.
d
e
v
e
l
o
p
m
e
n
t
.
Methods
M
e
t
h
o
d
s
1g
1
g
and
a
n
d
1i
1
i
are
a
r
e
not
n
o
t
applicable
a
p
p
l
i
c
a
b
l
e
in
i
n
assembler
a
s
s
e
m
b
l
e
r
programming.
p
r
o
g
r
a
m
m
i
n
g
.
!
!
:
:
Methods
M
e
t
h
o
d
s
1h
1
h
and
a
n
d
1i
1
i
reduce
r
e
d
u
c
e
the
t
h
e
potential
p
o
t
e
n
t
i
a
l
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
data
d
a
t
a
flow
f
l
o
w
and
a
n
d
control
c
o
n
t
r
o
l
flow
f
l
o
w
through
t
h
r
o
u
g
h
jumpsorglobal
j
u
m
p
s
o
r
g
l
o
b
a
l
variables.
v
a
r
i
a
b
l
e
s
.
NOTE
N
O
T
E
For
F
o
r
the
t
h
e
C
C
language,
l
a
n
g
u
a
g
e
,
MISRA
M
I
S
R
A
CIS!
C
I
S
!
covers
c
o
v
e
r
s
many
m
a
n
y
of
o
f
the
t
h
e
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
8.
8
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
8.4.5
8
.
4
.
5
The
T
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
verified
v
e
r
i
f
i
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011
2
6
2
6
2
-
8
:
2
0
1
1
Clause
C
l
a
u
s
e
9,
9
,
and
a
n
d
by
b
y
applying
a
p
p
l
y
i
n
g
the
t
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
9,
9
,
to
t
o
demonstrate:
d
e
m
o
n
s
t
r
a
t
e
:
-
the
t
h
e
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(in
(
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-5:2011,
2
6
2
6
2
-
5
:
2
0
1
1
,
6.4.10):
6
.
4
.
1
0
)
:
-
the
t
h
e
fulfilment
f
u
l
f
i
l
m
e
n
t
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
as
a
s
allocated
a
l
l
o
c
a
t
e
d
to
t
o
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
(in
(
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.4.9)
7
.
4
.
9
)
through
t
h
r
o
u
g
h
traceability;
t
r
a
c
e
a
b
i
l
i
t
y
;
-
the
t
h
e
complianceof
c
o
m
p
l
i
a
n
c
e
o
f
the
t
h
e
source
s
o
u
r
c
e
codewith
c
o
d
e
w
i
t
h
its
i
t
s
design
d
e
s
i
g
n
specification;
s
p
e
c
i
f
i
c
a
t
i
o
n
;
NOTE
N
O
T
E
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
requirement
r
e
q
u
i
r
e
m
e
n
t
C)
C
)
still
s
t
i
l
l
applies.
a
p
p
l
i
e
s
.
-
the
t
h
e
compliance
c
o
m
p
l
i
a
n
c
e
of
o
f
the
t
h
e
source
s
o
u
r
c
e
code
c
o
d
e
with
w
i
t
h
the
t
h
e
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
(see
(
s
e
e
5.5.3);
5
.
5
.
3
)
;
and
a
n
d
€)
€
)
the
t
h
e
compatibility
c
o
m
p
a
t
i
b
i
l
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
implementations
i
m
p
l
e
m
e
n
t
a
t
i
o
n
s
with
w
i
t
h
the
t
h
e
target
t
a
r
g
e
t
hardware.
h
a
r
d
w
a
r
e
.
Table
T
a
b
l
e
9
9
—
—
Methodsforthe
M
e
t
h
o
d
s
f
o
r
t
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
Methods
M
e
t
h
o
d
s
Walk-through?
W
a
l
k
-
t
h
r
o
u
g
h
?
|
|
:
:
Inspection?
I
n
s
p
e
c
t
i
o
n
?
Semi-formalverification
S
e
m
i
-
f
o
r
m
a
l
v
e
r
i
f
i
c
a
t
i
o
n
Formal
F
o
r
m
a
l
verification
v
e
r
i
f
i
c
a
t
i
o
n
Controlflow
C
o
n
t
r
o
l
f
l
o
w
analysis®.©
a
n
a
l
y
s
i
s
®
.
©
Data
D
a
t
a
flow
f
l
o
w
analysis®.°
a
n
a
l
y
s
i
s
®
.
°
1g
1
g
|Static
|
S
t
a
t
i
c
codeanalysis
c
o
d
e
a
n
a
l
y
s
i
s
Semantic
S
e
m
a
n
t
i
c
code
c
o
d
e
analysis9
a
n
a
l
y
s
i
s
9
3
3
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
software
s
o
f
t
w
a
r
e
developmentthe
d
e
v
e
l
o
p
m
e
n
t
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
can
c
a
n
beverified
b
e
v
e
r
i
f
i
e
d
at
a
t
the
t
h
e
modellevel.
m
o
d
e
l
l
e
v
e
l
.
5
5
Methods
M
e
t
h
o
d
s
te
t
e
and
a
n
d
1f
1
f
can
c
a
n
be
b
e
applied
a
p
p
l
i
e
d
at
a
t
the
t
h
e
source
s
o
u
r
c
e
code
c
o
d
e
level.
l
e
v
e
l
.
These
T
h
e
s
e
methods
m
e
t
h
o
d
s
are
a
r
e
applicable
a
p
p
l
i
c
a
b
l
e
both
b
o
t
h
to
t
o
manual
m
a
n
u
a
l
code
c
o
d
e
development
d
e
v
e
l
o
p
m
e
n
t
and
a
n
d
to
t
o
model-based
m
o
d
e
l
-
b
a
s
e
d
development.
d
e
v
e
l
o
p
m
e
n
t
.
°
°
Methods1e
M
e
t
h
o
d
s
1
e
and
a
n
d
1f
1
f
can
c
a
n
be
b
e
part
p
a
r
t
of
o
f
methods
m
e
t
h
o
d
s
1d,
1
d
,
1g
1
g
or
o
r
th.
t
h
.
d
d
Method
M
e
t
h
o
d
1h
1
h
is
i
s
used
u
s
e
d
for
f
o
r
mathematical
m
a
t
h
e
m
a
t
i
c
a
l
analysis
a
n
a
l
y
s
i
s
of
o
f
source
s
o
u
r
c
e
code
c
o
d
e
by
b
y
use
u
s
e
of
o
f
an
a
n
abstract
a
b
s
t
r
a
c
t
representation
r
e
p
r
e
s
e
n
t
a
t
i
o
n
of
o
f
possible
p
o
s
s
i
b
l
e
values
v
a
l
u
e
s
for
f
o
r
the
t
h
e
variables.
v
a
r
i
a
b
l
e
s
.
Forthis
F
o
r
t
h
i
s
it
i
t
is
i
s
not
n
o
t
necessary
n
e
c
e
s
s
a
r
y
to
t
o
translate
t
r
a
n
s
l
a
t
e
and
a
n
d
execute
e
x
e
c
u
t
e
the
t
h
e
source
s
o
u
r
c
e
code.
c
o
d
e
.
NOTE
N
O
T
E
Table
T
a
b
l
e
lists
l
i
s
t
s
only
o
n
l
y
static
s
t
a
t
i
c
verification
v
e
r
i
f
i
c
a
t
i
o
n
techniques.
t
e
c
h
n
i
q
u
e
s
.
Dynamic
D
y
n
a
m
i
c
verification
v
e
r
i
f
i
c
a
t
i
o
n
techniques
t
e
c
h
n
i
q
u
e
s
(e.g.
(
e
.
g
.
testing
t
e
s
t
i
n
g
techniques)
t
e
c
h
n
i
q
u
e
s
)
are
a
r
e
covered
c
o
v
e
r
e
d
in
i
n
Tables
T
a
b
l
e
s
10,
1
0
,
11
1
1
and
a
n
d
12.
1
2
.
8.5
8
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
8.5.1.
8
.
5
.
1
.
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
8.4.2
8
.
4
.
2
to
t
o
8.4.4.
8
.
4
.
4
.
NOTE
N
O
T
E
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
model
m
o
d
e
l
and
a
n
d
supporting
s
u
p
p
o
r
t
i
n
g
descriptive
d
e
s
c
r
i
p
t
i
v
e
documentation,
d
o
c
u
m
e
n
t
a
t
i
o
n
,
using
u
s
i
n
g
techniqueslisted
t
e
c
h
n
i
q
u
e
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
8,
8
,
specifies
s
p
e
c
i
f
i
e
s
the
t
h
e
software
s
o
f
t
w
a
r
e
units.
u
n
i
t
s
.
8.5.2
8
.
5
.
2
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
8.4.4.
8
.
4
.
4
.
8.5.3.
8
.
5
.
3
.
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
8.4.5.
8
.
4
.
5
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
9
9
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
9.1
9
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
is
i
s
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
fulfil
f
u
l
f
i
l
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specifications
s
p
e
c
i
f
i
c
a
t
i
o
n
s
and
a
n
d
do
d
o
not
n
o
t
contain
c
o
n
t
a
i
n
undesired
u
n
d
e
s
i
r
e
d
functionality.
f
u
n
c
t
i
o
n
a
l
i
t
y
.
9.2
9
.
2
General
G
e
n
e
r
a
l
A
A
procedure
p
r
o
c
e
d
u
r
e
for
f
o
r
testing
t
e
s
t
i
n
g
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
against
a
g
a
i
n
s
t
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specificationsis
s
p
e
c
i
f
i
c
a
t
i
o
n
s
i
s
established,
e
s
t
a
b
l
i
s
h
e
d
,
and
a
n
d
the
t
h
e
tests
t
e
s
t
s
are
a
r
e
carried
c
a
r
r
i
e
d
out
o
u
t
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
this
t
h
i
s
procedure.
p
r
o
c
e
d
u
r
e
.
9.3
9
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
9.3.1
9
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
6.5.2;
6
.
5
.
2
;
—
—
software
s
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
6.5.3;
6
.
5
.
3
;
—
—
safety
s
a
f
e
t
y
pian
p
i
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.2:
7
.
5
.
2
:
—
—
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
8.5.1;
8
.
5
.
1
;
—
—
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
8.5.2;
8
.
5
.
2
;
and
a
n
d
—
—
software
s
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
8.5.3.
8
.
5
.
3
.
9.3.2
9
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
tool
t
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.4;
5
.
5
.
4
;
and
a
n
d
—
—
guidelinesfor
g
u
i
d
e
l
i
n
e
s
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
9.4
9
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
9.4.1.
9
.
4
.
1
.
The
T
h
e
requirementsof
r
e
q
u
i
r
e
m
e
n
t
s
o
f
this
t
h
i
s
subclause
s
u
b
c
l
a
u
s
e
shall
s
h
a
l
l
be
b
e
complied
c
o
m
p
l
i
e
d
with
w
i
t
h
if
i
f
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
is
i
s
safety-related.
s
a
f
e
t
y
-
r
e
l
a
t
e
d
.
NOTE
N
O
T
E
“Safety-related”
“
S
a
f
e
t
y
-
r
e
l
a
t
e
d
”
meansthat
m
e
a
n
s
t
h
a
t
the
t
h
e
unit
u
n
i
t
implements
i
m
p
l
e
m
e
n
t
s
safety
s
a
f
e
t
y
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
orthat
o
r
t
h
a
t
the
t
h
e
criteria
c
r
i
t
e
r
i
a
for
f
o
r
coexistence
c
o
e
x
i
s
t
e
n
c
e
of
o
f
the
t
h
e
unit
u
n
i
t
with
w
i
t
h
other
o
t
h
e
r
units
u
n
i
t
s
are
a
r
e
not
n
o
t
satisfied.
s
a
t
i
s
f
i
e
d
.
9.4.2
9
.
4
.
2
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
shall
s
h
a
l
l
be
b
e
planned,
p
l
a
n
n
e
d
,
specified
s
p
e
c
i
f
i
e
d
and
a
n
d
executed
e
x
e
c
u
t
e
d
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9.
9
.
NOTE
N
O
T
E
1
1
Based
B
a
s
e
d
on
o
n
thedefinitions
t
h
e
d
e
f
i
n
i
t
i
o
n
s
in
i
n
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9,
9
,
the
t
h
e
test
t
e
s
t
objects
o
b
j
e
c
t
s
in
i
n
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
are
a
r
e
the
t
h
e
software
s
o
f
t
w
a
r
e
units.
u
n
i
t
s
.
NOTE
N
O
T
E
2.
2
.
For
F
o
r
model-based
m
o
d
e
l
-
b
a
s
e
d
software
s
o
f
t
w
a
r
e
development,
d
e
v
e
l
o
p
m
e
n
t
,
the
t
h
e
correspondingparts
c
o
r
r
e
s
p
o
n
d
i
n
g
p
a
r
t
s
of
o
f
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
model
m
o
d
e
l
also
a
l
s
o
represent
r
e
p
r
e
s
e
n
t
objects
o
b
j
e
c
t
s
for
f
o
r
the
t
h
e
test
t
e
s
t
planning.
p
l
a
n
n
i
n
g
.
Depending
D
e
p
e
n
d
i
n
g
on
o
n
the
t
h
e
selected
s
e
l
e
c
t
e
d
software
s
o
f
t
w
a
r
e
developmentprocess
d
e
v
e
l
o
p
m
e
n
t
p
r
o
c
e
s
s
the
t
h
e
test
t
e
s
t
objects
o
b
j
e
c
t
s
can
c
a
n
be
b
e
the
t
h
e
code
c
o
d
e
derived
d
e
r
i
v
e
d
from
f
r
o
m
this
t
h
i
s
model
m
o
d
e
l
or
o
r
the
t
h
e
modelitself.
m
o
d
e
l
i
t
s
e
l
f
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
9.4.3
9
.
4
.
3
The
T
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
10
1
0
shall
s
h
a
l
l
be
b
e
applied
a
p
p
l
i
e
d
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
achieve:
a
c
h
i
e
v
e
:
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(in
(
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
Clause8):
C
l
a
u
s
e
8
)
:
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
(in
(
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-5:2011,
2
6
2
6
2
-
5
:
2
0
1
1
,
6.4.10);
6
.
4
.
1
0
)
;
-
the
t
h
e
specified
s
p
e
c
i
f
i
e
d
functionality;
f
u
n
c
t
i
o
n
a
l
i
t
y
;
-
confidence
c
o
n
f
i
d
e
n
c
e
in
i
n
the
t
h
e
absence
a
b
s
e
n
c
e
of
o
f
unintended
u
n
i
n
t
e
n
d
e
d
functionality;
f
u
n
c
t
i
o
n
a
l
i
t
y
;
-
robustness;
r
o
b
u
s
t
n
e
s
s
;
and
a
n
d
EXAMPLE
E
X
A
M
P
L
E
The
T
h
e
absence
a
b
s
e
n
c
e
of
o
f
inaccessible
i
n
a
c
c
e
s
s
i
b
l
e
software,
s
o
f
t
w
a
r
e
,
the
t
h
e
effectiveness
e
f
f
e
c
t
i
v
e
n
e
s
s
of
o
f
error
e
r
r
o
r
detection
d
e
t
e
c
t
i
o
n
and
a
n
d
error
e
r
r
o
r
handling
h
a
n
d
l
i
n
g
mechanisms.
m
e
c
h
a
n
i
s
m
s
.
-
sufficient
s
u
f
f
i
c
i
e
n
t
resources
r
e
s
o
u
r
c
e
s
to
t
o
support
s
u
p
p
o
r
t
their
t
h
e
i
r
functionality.
f
u
n
c
t
i
o
n
a
l
i
t
y
.
Table
T
a
b
l
e
10
1
0
—
—
Methodsfor
M
e
t
h
o
d
s
f
o
r
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
1a
1
a
|
|
Requirements-basedtest?
R
e
q
u
i
r
e
m
e
n
t
s
-
b
a
s
e
d
t
e
s
t
?
Interface
I
n
t
e
r
f
a
c
e
test
t
e
s
t
|
|
Fault
F
a
u
l
t
injection
i
n
j
e
c
t
i
o
n
test®
t
e
s
t
®
|
|
Resource
R
e
s
o
u
r
c
e
usagetest®
u
s
a
g
e
t
e
s
t
®
Back-to-back
B
a
c
k
-
t
o
-
b
a
c
k
comparison
c
o
m
p
a
r
i
s
o
n
test
t
e
s
t
between
b
e
t
w
e
e
n
model
m
o
d
e
l
and
a
n
d
code,if
c
o
d
e
,
i
f
applicable?
a
p
p
l
i
c
a
b
l
e
?
a
a
Thesoftware
T
h
e
s
o
f
t
w
a
r
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
at
a
t
the
t
h
e
unit
u
n
i
t
level
l
e
v
e
l
are
a
r
e
the
t
h
e
basis
b
a
s
i
s
for
f
o
r
this
t
h
i
s
requirements-basedtest.
r
e
q
u
i
r
e
m
e
n
t
s
-
b
a
s
e
d
t
e
s
t
.
>
>
This
T
h
i
s
includes
i
n
c
l
u
d
e
s
injection
i
n
j
e
c
t
i
o
n
of
o
f
arbitrary
a
r
b
i
t
r
a
r
y
faults
f
a
u
l
t
s
(e.g.
(
e
.
g
.
by
b
y
corrupting
c
o
r
r
u
p
t
i
n
g
values
v
a
l
u
e
s
of
o
f
variables,
v
a
r
i
a
b
l
e
s
,
by
b
y
introducing
i
n
t
r
o
d
u
c
i
n
g
code
c
o
d
e
mutations,
m
u
t
a
t
i
o
n
s
,
or
o
r
by
b
y
corrupting
c
o
r
r
u
p
t
i
n
g
values
v
a
l
u
e
s
of
o
f
CPU
C
P
U
registers).
r
e
g
i
s
t
e
r
s
)
.
©
©
Someaspects
S
o
m
e
a
s
p
e
c
t
s
of
o
f
the
t
h
e
resource
r
e
s
o
u
r
c
e
usagetest
u
s
a
g
e
t
e
s
t
can
c
a
n
only
o
n
l
y
be
b
e
evaluated:
e
v
a
l
u
a
t
e
d
:
properly
p
r
o
p
e
r
l
y
when
w
h
e
n
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
tests
t
e
s
t
s
are
a
r
e
executed
e
x
e
c
u
t
e
d
on
o
n
the
t
h
e
target
t
a
r
g
e
t
hardwareor
h
a
r
d
w
a
r
e
o
r
if
i
f
the
t
h
e
emulator
e
m
u
l
a
t
o
r
for
f
o
r
the
t
h
e
target
t
a
r
g
e
t
processor
p
r
o
c
e
s
s
o
r
supports
s
u
p
p
o
r
t
s
resource
r
e
s
o
u
r
c
e
usagetests.
u
s
a
g
e
t
e
s
t
s
.
3
3
This
T
h
i
s
method
m
e
t
h
o
d
requires
r
e
q
u
i
r
e
s
a
a
model
m
o
d
e
l
that
t
h
a
t
can
c
a
n
simulate
s
i
m
u
l
a
t
e
the
t
h
e
functionality
f
u
n
c
t
i
o
n
a
l
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
units.
u
n
i
t
s
.
Here,
H
e
r
e
,
the
t
h
e
model
m
o
d
e
l
and
a
n
d
codearestimulated
c
o
d
e
a
r
e
s
t
i
m
u
l
a
t
e
d
in
i
n
the
t
h
e
same
s
a
m
e
way
w
a
y
and
a
n
d
results
r
e
s
u
l
t
s
compared
c
o
m
p
a
r
e
d
with
w
i
t
h
each
e
a
c
h
other.
o
t
h
e
r
.
9.4.4
9
.
4
.
4
To
T
o
enable
e
n
a
b
l
e
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
appropriate
a
p
p
r
o
p
r
i
a
t
e
test
t
e
s
t
cases
c
a
s
e
s
for
f
o
r
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
9.4.3,
9
.
4
.
3
,
test
t
e
s
t
cases
c
a
s
e
s
shall
s
h
a
l
l
be
b
e
derived
d
e
r
i
v
e
d
using
u
s
i
n
g
the
t
h
e
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
11.
1
1
.
Table
T
a
b
l
e
11
1
1
—
—
Methodsfor
M
e
t
h
o
d
s
f
o
r
deriving
d
e
r
i
v
i
n
g
test
t
e
s
t
cases
c
a
s
e
s
for
f
o
r
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
Methods
M
e
t
h
o
d
s
Analysis
A
n
a
l
y
s
i
s
of
o
f
requirements
r
e
q
u
i
r
e
m
e
n
t
s
Generation
G
e
n
e
r
a
t
i
o
n
and
a
n
d
analysis
a
n
a
l
y
s
i
s
of
o
f
equivalence
e
q
u
i
v
a
l
e
n
c
e
classes@
c
l
a
s
s
e
s
@
|
|
Analysis
A
n
a
l
y
s
i
s
of
o
f
boundary
b
o
u
n
d
a
r
y
values?
v
a
l
u
e
s
?
Error
E
r
r
o
r
guessing®
g
u
e
s
s
i
n
g
®
@
@
Equivalence
E
q
u
i
v
a
l
e
n
c
e
classes
c
l
a
s
s
e
s
can
c
a
n
beidentified
b
e
i
d
e
n
t
i
f
i
e
d
based
b
a
s
e
d
on
o
n
the
t
h
e
division
d
i
v
i
s
i
o
n
of
o
f
inputs
i
n
p
u
t
s
and
a
n
d
outputs,
o
u
t
p
u
t
s
,
such
s
u
c
h
that
t
h
a
t
a
a
representative
r
e
p
r
e
s
e
n
t
a
t
i
v
e
test
t
e
s
t
value
v
a
l
u
e
can
c
a
n
be
b
e
selected
s
e
l
e
c
t
e
d
for
f
o
r
each
e
a
c
h
class.
c
l
a
s
s
.
5
5
This
T
h
i
s
method
m
e
t
h
o
d
applies
a
p
p
l
i
e
s
to
t
o
interfaces,
i
n
t
e
r
f
a
c
e
s
,
values
v
a
l
u
e
s
approaching
a
p
p
r
o
a
c
h
i
n
g
and
a
n
d
crossing
c
r
o
s
s
i
n
g
the
t
h
e
boundaries
b
o
u
n
d
a
r
i
e
s
and
a
n
d
out
o
u
t
of
o
f
range
r
a
n
g
e
values.
v
a
l
u
e
s
.
©
©
Error
E
r
r
o
r
guessing
g
u
e
s
s
i
n
g
tests
t
e
s
t
s
can
c
a
n
be
b
e
based
b
a
s
e
d
on
o
n
data
d
a
t
a
collected
c
o
l
l
e
c
t
e
d
through
t
h
r
o
u
g
h
a
a
“lessons
“
l
e
s
s
o
n
s
learned”
l
e
a
r
n
e
d
”
process
p
r
o
c
e
s
s
and
a
n
d
expert
e
x
p
e
r
t
judgment.
j
u
d
g
m
e
n
t
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
9.4.5
9
.
4
.
5
To
T
o
evaluate
e
v
a
l
u
a
t
e
the
t
h
e
completeness
c
o
m
p
l
e
t
e
n
e
s
s
of
o
f
test
t
e
s
t
cases
c
a
s
e
s
and
a
n
d
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
there
t
h
e
r
e
is
i
s
no
n
o
unintended
u
n
i
n
t
e
n
d
e
d
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
functionality,
f
u
n
c
t
i
o
n
a
l
i
t
y
,
the
t
h
e
coverage
c
o
v
e
r
a
g
e
of
o
f
requirements
r
e
q
u
i
r
e
m
e
n
t
s
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
level
l
e
v
e
l
shall
s
h
a
l
l
be
b
e
determined
d
e
t
e
r
m
i
n
e
d
and
a
n
d
the
t
h
e
structural
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
shall
s
h
a
l
l
be
b
e
measured
m
e
a
s
u
r
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
metrics
m
e
t
r
i
c
s
listed
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
12.
1
2
.
If
I
f
the
t
h
e
achieved
a
c
h
i
e
v
e
d
structural
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
is
i
s
considered
c
o
n
s
i
d
e
r
e
d
insufficient,
i
n
s
u
f
f
i
c
i
e
n
t
,
either
e
i
t
h
e
r
additional
a
d
d
i
t
i
o
n
a
l
test
t
e
s
t
cases
c
a
s
e
s
shall
s
h
a
l
l
be
b
e
specified
s
p
e
c
i
f
i
e
d
or
o
r
a
a
rationale
r
a
t
i
o
n
a
l
e
shall
s
h
a
l
l
be
b
e
provided.
p
r
o
v
i
d
e
d
.
EXAMPLE1
E
X
A
M
P
L
E
1
Analysis
A
n
a
l
y
s
i
s
of
o
f
structural
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
can
c
a
n
reveal
r
e
v
e
a
l
shortcomings
s
h
o
r
t
c
o
m
i
n
g
s
in
i
n
requirement-based
r
e
q
u
i
r
e
m
e
n
t
-
b
a
s
e
d
test
t
e
s
t
cases,
c
a
s
e
s
,
inadequacies
i
n
a
d
e
q
u
a
c
i
e
s
in
i
n
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
dead
d
e
a
d
code,
c
o
d
e
,
deactivated
d
e
a
c
t
i
v
a
t
e
d
code
c
o
d
e
or
o
r
unintended
u
n
i
n
t
e
n
d
e
d
functionality.
f
u
n
c
t
i
o
n
a
l
i
t
y
.
EXAMPLE2
E
X
A
M
P
L
E
2
A
A
rationale
r
a
t
i
o
n
a
l
e
can
c
a
n
be
b
e
given
g
i
v
e
n
for
f
o
r
the
t
h
e
level
l
e
v
e
l
of
o
f
coverage
c
o
v
e
r
a
g
e
achieved
a
c
h
i
e
v
e
d
based
b
a
s
e
d
on
o
n
accepted
a
c
c
e
p
t
e
d
dead
d
e
a
d
code(e.g.
c
o
d
e
(
e
.
g
.
code
c
o
d
e
for
f
o
r
debugging)
d
e
b
u
g
g
i
n
g
)
or
o
r
code
c
o
d
e
segments
s
e
g
m
e
n
t
s
depending
d
e
p
e
n
d
i
n
g
on
o
n
different
d
i
f
f
e
r
e
n
t
software
s
o
f
t
w
a
r
e
configurations;
c
o
n
f
i
g
u
r
a
t
i
o
n
s
;
or
o
r
code
c
o
d
e
not
n
o
t
covered
c
o
v
e
r
e
d
can
c
a
n
beverified
b
e
v
e
r
i
f
i
e
d
using
u
s
i
n
g
complementary
c
o
m
p
l
e
m
e
n
t
a
r
y
methods(e.g.
m
e
t
h
o
d
s
(
e
.
g
.
inspections).
i
n
s
p
e
c
t
i
o
n
s
)
.
Table
T
a
b
l
e
12
1
2
—
—
Structural
S
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
metrics
m
e
t
r
i
c
s
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
unitlevel
u
n
i
t
l
e
v
e
l
Methods
M
e
t
h
o
d
s
Statement
S
t
a
t
e
m
e
n
t
coverage
c
o
v
e
r
a
g
e
Branch
B
r
a
n
c
h
coverage
c
o
v
e
r
a
g
e
MC/DC
M
C
/
D
C
(Modified
(
M
o
d
i
f
i
e
d
Condition/Decision
C
o
n
d
i
t
i
o
n
/
D
e
c
i
s
i
o
n
Coverage)
C
o
v
e
r
a
g
e
)
NOTE
N
O
T
E
1
1
Thestructural
T
h
e
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
can
c
a
n
be
b
e
determined
d
e
t
e
r
m
i
n
e
d
by
b
y
the
t
h
e
use
u
s
e
of
o
f
appropriate
a
p
p
r
o
p
r
i
a
t
e
softwaretools.
s
o
f
t
w
a
r
e
t
o
o
l
s
.
NOTE
N
O
T
E
2
2
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
the
t
h
e
analysis
a
n
a
l
y
s
i
s
of
o
f
structural
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
can
c
a
n
be
b
e
performed
p
e
r
f
o
r
m
e
d
at
a
t
the
t
h
e
model
m
o
d
e
l
level
l
e
v
e
l
using
u
s
i
n
g
analogousstructural
a
n
a
l
o
g
o
u
s
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
metrics
m
e
t
r
i
c
s
for
f
o
r
models.
m
o
d
e
l
s
.
NOTE
N
O
T
E
3
3
If
I
f
instrumented
i
n
s
t
r
u
m
e
n
t
e
d
code
c
o
d
e
is
i
s
used
u
s
e
d
to
t
o
determine
d
e
t
e
r
m
i
n
e
the
t
h
e
degree
d
e
g
r
e
e
of
o
f
coverage,
c
o
v
e
r
a
g
e
,
it
i
t
can
c
a
n
be
b
e
necessary
n
e
c
e
s
s
a
r
y
to
t
o
show
s
h
o
w
that
t
h
a
t
the
t
h
e
instrumentation
i
n
s
t
r
u
m
e
n
t
a
t
i
o
n
has
h
a
s
no
n
o
effect
e
f
f
e
c
t
on
o
n
the
t
h
e
test
t
e
s
t
results.
r
e
s
u
l
t
s
.
This
T
h
i
s
can
c
a
n
be
b
e
done
d
o
n
e
by
b
y
repeating
r
e
p
e
a
t
i
n
g
the
t
h
e
tests
t
e
s
t
s
with
w
i
t
h
non-instrumented
n
o
n
-
i
n
s
t
r
u
m
e
n
t
e
d
code.
c
o
d
e
.
9.4.6
9
.
4
.
6
The
T
h
e
test
t
e
s
t
environment
e
n
v
i
r
o
n
m
e
n
t
for
f
o
r
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
shall
s
h
a
l
l
correspond
c
o
r
r
e
s
p
o
n
d
as
a
s
closely
c
l
o
s
e
l
y
as
a
s
possible
p
o
s
s
i
b
l
e
to
t
o
the
t
h
e
target
t
a
r
g
e
t
environment.
e
n
v
i
r
o
n
m
e
n
t
.
If
I
f
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
is
i
s
not
n
o
t
carried
c
a
r
r
i
e
d
out
o
u
t
in
i
n
the
t
h
e
target
t
a
r
g
e
t
environment,
e
n
v
i
r
o
n
m
e
n
t
,
the
t
h
e
differences
d
i
f
f
e
r
e
n
c
e
s
in
i
n
the
t
h
e
source
s
o
u
r
c
e
and
a
n
d
object
o
b
j
e
c
t
code,
c
o
d
e
,
and
a
n
d
the
t
h
e
differences
d
i
f
f
e
r
e
n
c
e
s
between
b
e
t
w
e
e
n
the
t
h
e
test
t
e
s
t
environment
e
n
v
i
r
o
n
m
e
n
t
and
a
n
d
the
t
h
e
target
t
a
r
g
e
t
environment,
e
n
v
i
r
o
n
m
e
n
t
,
shall
s
h
a
l
l
be
b
e
analysed
a
n
a
l
y
s
e
d
in
i
n
orderto
o
r
d
e
r
t
o
specify
s
p
e
c
i
f
y
additional
a
d
d
i
t
i
o
n
a
l
tests
t
e
s
t
s
in
i
n
the
t
h
e
target
t
a
r
g
e
t
environment
e
n
v
i
r
o
n
m
e
n
t
during
d
u
r
i
n
g
the
t
h
e
subsequenttest
s
u
b
s
e
q
u
e
n
t
t
e
s
t
phases.
p
h
a
s
e
s
.
NOTE1
N
O
T
E
1
Differences
D
i
f
f
e
r
e
n
c
e
s
between
b
e
t
w
e
e
n
the
t
h
e
test
t
e
s
t
environment
e
n
v
i
r
o
n
m
e
n
t
and
a
n
d
the
t
h
e
target
t
a
r
g
e
t
environment
e
n
v
i
r
o
n
m
e
n
t
can
c
a
n
arise
a
r
i
s
e
in
i
n
the
t
h
e
source
s
o
u
r
c
e
code
c
o
d
e
or
o
r
object
o
b
j
e
c
t
code,
c
o
d
e
,
for
f
o
r
example,
e
x
a
m
p
l
e
,
due
d
u
e
to
t
o
different
d
i
f
f
e
r
e
n
t
bit
b
i
t
widths
w
i
d
t
h
s
of
o
f
data
d
a
t
a
words
w
o
r
d
s
and
a
n
d
address
a
d
d
r
e
s
s
wordsof
w
o
r
d
s
o
f
the
t
h
e
processors.
p
r
o
c
e
s
s
o
r
s
.
NOTE
N
O
T
E
2
2
Depending
D
e
p
e
n
d
i
n
g
on
o
n
the
t
h
e
scopeofthetests,
s
c
o
p
e
o
f
t
h
e
t
e
s
t
s
,
the
t
h
e
appropriate
a
p
p
r
o
p
r
i
a
t
e
test
t
e
s
t
environmentfor
e
n
v
i
r
o
n
m
e
n
t
f
o
r
the
t
h
e
execution
e
x
e
c
u
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
is
i
s
used
u
s
e
d
(e.g.
(
e
.
g
.
the
t
h
e
target
t
a
r
g
e
t
processor,
p
r
o
c
e
s
s
o
r
,
a
a
processor
p
r
o
c
e
s
s
o
r
emulator
e
m
u
l
a
t
o
r
or
o
r
a
a
development
d
e
v
e
l
o
p
m
e
n
t
system).
s
y
s
t
e
m
)
.
NOTE3
N
O
T
E
3
Softwareunit
S
o
f
t
w
a
r
e
u
n
i
t
testing
t
e
s
t
i
n
g
can
c
a
n
be
b
e
executed
e
x
e
c
u
t
e
d
in
i
n
different
d
i
f
f
e
r
e
n
t
environments,for
e
n
v
i
r
o
n
m
e
n
t
s
,
f
o
r
example:
e
x
a
m
p
l
e
:
—
—
model-in-the-looptests;
m
o
d
e
l
-
i
n
-
t
h
e
-
l
o
o
p
t
e
s
t
s
;
—
—
software-in-the-loop
s
o
f
t
w
a
r
e
-
i
n
-
t
h
e
-
l
o
o
p
tests;
t
e
s
t
s
;
—
—
processor-in-the-loop
p
r
o
c
e
s
s
o
r
-
i
n
-
t
h
e
-
l
o
o
p
tests;
t
e
s
t
s
;
and
a
n
d
—
—
__hardware-in-the-looptests.
_
_
h
a
r
d
w
a
r
e
-
i
n
-
t
h
e
-
l
o
o
p
t
e
s
t
s
.
NOTE
N
O
T
E
4
4
For
F
o
r
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
testing
t
e
s
t
i
n
g
can
c
a
n
be
b
e
carried
c
a
r
r
i
e
d
out
o
u
t
at
a
t
the
t
h
e
modellevelfollowed
m
o
d
e
l
l
e
v
e
l
f
o
l
l
o
w
e
d
by
b
y
back-to-
b
a
c
k
-
t
o
-
back
b
a
c
k
comparison
c
o
m
p
a
r
i
s
o
n
tests
t
e
s
t
s
between
b
e
t
w
e
e
n
the
t
h
e
model
m
o
d
e
l
and
a
n
d
the
t
h
e
object
o
b
j
e
c
t
code.
c
o
d
e
.
The
T
h
e
back-to-back
b
a
c
k
-
t
o
-
b
a
c
k
comparison
c
o
m
p
a
r
i
s
o
n
tests
t
e
s
t
s
are
a
r
e
used
u
s
e
d
to
t
o
ensure
e
n
s
u
r
e
that
t
h
a
t
the
t
h
e
behaviour
b
e
h
a
v
i
o
u
r
of
o
f
the
t
h
e
models
m
o
d
e
l
s
with
w
i
t
h
regard
r
e
g
a
r
d
to
t
o
the
t
h
e
test
t
e
s
t
objectives
o
b
j
e
c
t
i
v
e
s
is
i
s
equivalentto
e
q
u
i
v
a
l
e
n
t
t
o
the
t
h
e
automatically-generated
a
u
t
o
m
a
t
i
c
a
l
l
y
-
g
e
n
e
r
a
t
e
d
code.
c
o
d
e
.
9.5
9
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
9.5.1
9
.
5
.
1
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
9.4.2
9
.
4
.
2
to
t
o
9.4.6.
9
.
4
.
6
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
9.5.2
9
.
5
.
2
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
9.4.2
9
.
4
.
2
and
a
n
d
9.4.4
9
.
4
.
4
to
t
o
9.4.6.
9
.
4
.
6
.
9.5.3
9
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
9.4.2.
9
.
4
.
2
.
10
1
0
Software
S
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing
t
e
s
t
i
n
g
10.1
1
0
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
Thefirst
T
h
e
f
i
r
s
t
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phaseis
s
u
b
-
p
h
a
s
e
i
s
to
t
o
integrate
i
n
t
e
g
r
a
t
e
the
t
h
e
software
s
o
f
t
w
a
r
e
elements.
e
l
e
m
e
n
t
s
.
The
T
h
e
second
s
e
c
o
n
d
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
is
i
s
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
is
i
s
realized
r
e
a
l
i
z
e
d
by
b
y
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software.
s
o
f
t
w
a
r
e
.
10.2
1
0
.
2
General
G
e
n
e
r
a
l
In
I
n
this
t
h
i
s
sub-phase,
s
u
b
-
p
h
a
s
e
,
the
t
h
e
particular
p
a
r
t
i
c
u
l
a
r
integration
i
n
t
e
g
r
a
t
i
o
n
levels
l
e
v
e
l
s
and
a
n
d
the
t
h
e
interfaces
i
n
t
e
r
f
a
c
e
s
between
b
e
t
w
e
e
n
the
t
h
e
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
are
a
r
e
tested
t
e
s
t
e
d
against
a
g
a
i
n
s
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design.
d
e
s
i
g
n
.
The
T
h
e
steps
s
t
e
p
s
of
o
f
the
t
h
e
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing
t
e
s
t
i
n
g
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
corresponddirectly
c
o
r
r
e
s
p
o
n
d
d
i
r
e
c
t
l
y
to
t
o
the
t
h
e
hierarchical
h
i
e
r
a
r
c
h
i
c
a
l
architecture
a
r
c
h
i
t
e
c
t
u
r
e
of
o
f
the
t
h
e
software.
s
o
f
t
w
a
r
e
.
The
T
h
e
embeddedsoftware
e
m
b
e
d
d
e
d
s
o
f
t
w
a
r
e
canconsistof
c
a
n
c
o
n
s
i
s
t
o
f
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
and
a
n
d
non-safety-related
n
o
n
-
s
a
f
e
t
y
-
r
e
l
a
t
e
d
software
s
o
f
t
w
a
r
e
elements.
e
l
e
m
e
n
t
s
.
10.3
1
0
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
10.3.1
1
0
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
hardware-softwareinterface
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
6.5.2:
6
.
5
.
2
:
—
—
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.1:
7
.
5
.
1
:
—
—
safety
s
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.2:
7
.
5
.
2
:
—
—
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
8.5.2:
8
.
5
.
2
:
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
9.5.1;
9
.
5
.
1
;
—
—
software
s
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
9.5.2;
9
.
5
.
2
;
and
a
n
d
—
—
software
s
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
9.5.3.
9
.
5
.
3
.
10.3.2
1
0
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
qualified
q
u
a
l
i
f
i
e
d
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
available
a
v
a
i
l
a
b
l
e
(see
(
s
e
e
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
12);
1
2
)
;
—
—
software
s
o
f
t
w
a
r
e
tool
t
o
o
l
qualification
q
u
a
l
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
11.5.2:
1
1
.
5
.
2
:
—
—
tool
t
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.4;
5
.
5
.
4
;
and
a
n
d
—
—
guidelinesfor
g
u
i
d
e
l
i
n
e
s
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
10.4
1
0
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
10.4.1
1
0
.
4
.
1
The
T
h
e
planning
p
l
a
n
n
i
n
g
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
shall
s
h
a
l
l
describe
d
e
s
c
r
i
b
e
the
t
h
e
steps
s
t
e
p
s
for
f
o
r
integrating
i
n
t
e
g
r
a
t
i
n
g
the
t
h
e
individual
i
n
d
i
v
i
d
u
a
l
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
hierarchically
h
i
e
r
a
r
c
h
i
c
a
l
l
y
into
i
n
t
o
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
until
u
n
t
i
l
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
is
i
s
fully
f
u
l
l
y
integrated,
i
n
t
e
g
r
a
t
e
d
,
and
a
n
d
shall
s
h
a
l
l
consider:
c
o
n
s
i
d
e
r
:
-
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
dependencies
d
e
p
e
n
d
e
n
c
i
e
s
that
t
h
a
t
are
a
r
e
relevant
r
e
l
e
v
a
n
t
for
f
o
r
software
s
o
f
t
w
a
r
e
integration;
i
n
t
e
g
r
a
t
i
o
n
;
and
a
n
d
-
the
t
h
e
dependencies
d
e
p
e
n
d
e
n
c
i
e
s
betweenthe
b
e
t
w
e
e
n
t
h
e
softwareintegration
s
o
f
t
w
a
r
e
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
integration.
i
n
t
e
g
r
a
t
i
o
n
.
NOTE
N
O
T
E
For
F
o
r
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
the
t
h
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
can
c
a
n
be
b
e
replaced
r
e
p
l
a
c
e
d
with
w
i
t
h
integration
i
n
t
e
g
r
a
t
i
o
n
at
a
t
the
t
h
e
modellevel
m
o
d
e
l
l
e
v
e
l
and
a
n
d
subsequent
s
u
b
s
e
q
u
e
n
t
automatic
a
u
t
o
m
a
t
i
c
code
c
o
d
e
generation
g
e
n
e
r
a
t
i
o
n
from
f
r
o
m
the
t
h
e
integrated
i
n
t
e
g
r
a
t
e
d
model.
m
o
d
e
l
.
10.4.2
1
0
.
4
.
2
Software
S
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
shall
s
h
a
l
l
be
b
e
planned,
p
l
a
n
n
e
d
,
specified
s
p
e
c
i
f
i
e
d
and
a
n
d
executed
e
x
e
c
u
t
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9.
9
.
NOTE1
N
O
T
E
1
Based
B
a
s
e
d
onthe
o
n
t
h
e
definitions
d
e
f
i
n
i
t
i
o
n
s
in
i
n
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9,
9
,
the
t
h
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
test
t
e
s
t
objects
o
b
j
e
c
t
s
are
a
r
e
the
t
h
e
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
NOTE
N
O
T
E
2
2
For
F
o
r
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
the
t
h
e
test
t
e
s
t
objects
o
b
j
e
c
t
s
can
c
a
n
be
b
e
the
t
h
e
models
m
o
d
e
l
s
associated
a
s
s
o
c
i
a
t
e
d
with
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
10.4.3.
1
0
.
4
.
3
.
The
T
h
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
test
t
e
s
t
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
13
1
3
shall
s
h
a
l
l
be
b
e
applied
a
p
p
l
i
e
d
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
both
b
o
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
and
a
n
d
the
t
h
e
embeddedsoftware
e
m
b
e
d
d
e
d
s
o
f
t
w
a
r
e
achieve:
a
c
h
i
e
v
e
:
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
Clause
C
l
a
u
s
e
7;
7
;
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Clause
C
l
a
u
s
e
7;
7
;
-
the
t
h
e
specified
s
p
e
c
i
f
i
e
d
functionality;
f
u
n
c
t
i
o
n
a
l
i
t
y
;
-
robustness;
r
o
b
u
s
t
n
e
s
s
;
and
a
n
d
EXAMPLE
E
X
A
M
P
L
E
Absenceof
A
b
s
e
n
c
e
o
f
inaccessible
i
n
a
c
c
e
s
s
i
b
l
e
software;
s
o
f
t
w
a
r
e
;
effective
e
f
f
e
c
t
i
v
e
error
e
r
r
o
r
detection
d
e
t
e
c
t
i
o
n
and
a
n
d
handling.
h
a
n
d
l
i
n
g
.
-
sufficient
s
u
f
f
i
c
i
e
n
t
resources
r
e
s
o
u
r
c
e
s
to
t
o
support
s
u
p
p
o
r
t
the
t
h
e
functionality.
f
u
n
c
t
i
o
n
a
l
i
t
y
.
Table
T
a
b
l
e
13
1
3
—
—
Methodsfor
M
e
t
h
o
d
s
f
o
r
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
Requirements-basedtest®
R
e
q
u
i
r
e
m
e
n
t
s
-
b
a
s
e
d
t
e
s
t
®
Interface
I
n
t
e
r
f
a
c
e
test
t
e
s
t
|
|
Fault
F
a
u
l
t
injection
i
n
j
e
c
t
i
o
n
test®
t
e
s
t
®
Resource
R
e
s
o
u
r
c
e
usagetest
u
s
a
g
e
t
e
s
t
Back-to-back
B
a
c
k
-
t
o
-
b
a
c
k
comparison
c
o
m
p
a
r
i
s
o
n
test
t
e
s
t
between
b
e
t
w
e
e
n
modeland
m
o
d
e
l
a
n
d
code,
c
o
d
e
,
if
i
f
applicable®
a
p
p
l
i
c
a
b
l
e
®
The
T
h
e
software
s
o
f
t
w
a
r
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
at
a
t
the
t
h
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level
l
e
v
e
l
are
a
r
e
the
t
h
e
basis
b
a
s
i
s
for
f
o
r
this
t
h
i
s
requirements-basedtest.
r
e
q
u
i
r
e
m
e
n
t
s
-
b
a
s
e
d
t
e
s
t
.
This
T
h
i
s
includesinjection
i
n
c
l
u
d
e
s
i
n
j
e
c
t
i
o
n
of
o
f
arbitrary
a
r
b
i
t
r
a
r
y
faults
f
a
u
l
t
s
in
i
n
order
o
r
d
e
r
to
t
o
test
t
e
s
t
safety
s
a
f
e
t
y
mechanisms(e.g.
m
e
c
h
a
n
i
s
m
s
(
e
.
g
.
by
b
y
corrupting
c
o
r
r
u
p
t
i
n
g
software
s
o
f
t
w
a
r
e
or
o
r
hardware
h
a
r
d
w
a
r
e
components).
c
o
m
p
o
n
e
n
t
s
)
.
©
©
To
T
o
ensure
e
n
s
u
r
e
the
t
h
e
fulfilment
f
u
l
f
i
l
m
e
n
t
of
o
f
requirements
r
e
q
u
i
r
e
m
e
n
t
s
influenced
i
n
f
l
u
e
n
c
e
d
by
b
y
the
t
h
e
hardware
h
a
r
d
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
with
w
i
t
h
sufficient
s
u
f
f
i
c
i
e
n
t
tolerance,
t
o
l
e
r
a
n
c
e
,
properties
p
r
o
p
e
r
t
i
e
s
such
s
u
c
h
as
a
s
average
a
v
e
r
a
g
e
and
a
n
d
maximum
m
a
x
i
m
u
m
processor
p
r
o
c
e
s
s
o
r
performance,
p
e
r
f
o
r
m
a
n
c
e
,
minimum
m
i
n
i
m
u
m
or
o
r
maximum
m
a
x
i
m
u
m
execution
e
x
e
c
u
t
i
o
n
times,
t
i
m
e
s
,
storage
s
t
o
r
a
g
e
usage
u
s
a
g
e
(e.g.
(
e
.
g
.
RAM
R
A
M
for
f
o
r
stack
s
t
a
c
k
and
a
n
d
heap,
h
e
a
p
,
ROMfor
R
O
M
f
o
r
program
p
r
o
g
r
a
m
and
a
n
d
data)
d
a
t
a
)
and
a
n
d
the
t
h
e
bandwidth
b
a
n
d
w
i
d
t
h
of
o
f
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
links
l
i
n
k
s
(e.g.
(
e
.
g
.
data
d
a
t
a
buses)
b
u
s
e
s
)
have
h
a
v
e
to
t
o
be
b
e
determined.
d
e
t
e
r
m
i
n
e
d
.
3
3
Someaspects
S
o
m
e
a
s
p
e
c
t
s
of
o
f
the
t
h
e
resource
r
e
s
o
u
r
c
e
usage
u
s
a
g
e
test
t
e
s
t
can
c
a
n
only
o
n
l
y
be
b
e
evaluated
e
v
a
l
u
a
t
e
d
properly
p
r
o
p
e
r
l
y
when
w
h
e
n
the
t
h
e
softwareintegration
s
o
f
t
w
a
r
e
i
n
t
e
g
r
a
t
i
o
n
tests
t
e
s
t
s
are
a
r
e
executed
e
x
e
c
u
t
e
d
on
o
n
the
t
h
e
target
t
a
r
g
e
t
hardwareorif
h
a
r
d
w
a
r
e
o
r
i
f
the
t
h
e
emulator
e
m
u
l
a
t
o
r
for
f
o
r
the
t
h
e
target
t
a
r
g
e
t
processor
p
r
o
c
e
s
s
o
r
supports
s
u
p
p
o
r
t
s
resource
r
e
s
o
u
r
c
e
usagetests.
u
s
a
g
e
t
e
s
t
s
.
€
€
This
T
h
i
s
method
m
e
t
h
o
d
requires
r
e
q
u
i
r
e
s
a
a
model
m
o
d
e
l
that
t
h
a
t
can
c
a
n
simulate
s
i
m
u
l
a
t
e
the
t
h
e
functionality
f
u
n
c
t
i
o
n
a
l
i
t
y
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
components.
c
o
m
p
o
n
e
n
t
s
.
Here,
H
e
r
e
,
the
t
h
e
model
m
o
d
e
l
and
a
n
d
code
c
o
d
e
are
a
r
e
stimulated
s
t
i
m
u
l
a
t
e
d
in
i
n
the
t
h
e
same
s
a
m
e
way
w
a
y
and
a
n
d
results
r
e
s
u
l
t
s
compared
c
o
m
p
a
r
e
d
with
w
i
t
h
each
e
a
c
h
other.
o
t
h
e
r
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
10.4.4
1
0
.
4
.
4
To
T
o
enable
e
n
a
b
l
e
the
t
h
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
appropriate
a
p
p
r
o
p
r
i
a
t
e
test
t
e
s
t
cases
c
a
s
e
s
for
f
o
r
the
t
h
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
test
t
e
s
t
methods
m
e
t
h
o
d
s
selected
s
e
l
e
c
t
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
10.4.3,
1
0
.
4
.
3
,
test
t
e
s
t
cases
c
a
s
e
s
shall
s
h
a
l
l
be
b
e
derived
d
e
r
i
v
e
d
using
u
s
i
n
g
the
t
h
e
methodslisted
m
e
t
h
o
d
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
14.
1
4
.
Table
T
a
b
l
e
14
1
4
—
—
Methodsfor
M
e
t
h
o
d
s
f
o
r
deriving
d
e
r
i
v
i
n
g
test
t
e
s
t
cases
c
a
s
e
s
for
f
o
r
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
Methods
M
e
t
h
o
d
s
Analysis
A
n
a
l
y
s
i
s
of
o
f
requirements
r
e
q
u
i
r
e
m
e
n
t
s
1b
1
b
|
|
Generation
G
e
n
e
r
a
t
i
o
n
ana
a
n
a
analysis
a
n
a
l
y
s
i
s
of
o
f
equivalence
e
q
u
i
v
a
l
e
n
c
e
classes#
c
l
a
s
s
e
s
#
Analysis
A
n
a
l
y
s
i
s
of
o
f
boundary
b
o
u
n
d
a
r
y
values®
v
a
l
u
e
s
®
Error
E
r
r
o
r
guessing®
g
u
e
s
s
i
n
g
®
@
@
Equivalence
E
q
u
i
v
a
l
e
n
c
e
classes
c
l
a
s
s
e
s
can
c
a
n
be
b
e
identified
i
d
e
n
t
i
f
i
e
d
based
b
a
s
e
d
on
o
n
the
t
h
e
division
d
i
v
i
s
i
o
n
of
o
f
inputs
i
n
p
u
t
s
and
a
n
d
outputs,
o
u
t
p
u
t
s
,
such
s
u
c
h
that
t
h
a
t
a
a
representative
r
e
p
r
e
s
e
n
t
a
t
i
v
e
test
t
e
s
t
value
v
a
l
u
e
can
c
a
n
be
b
e
selected
s
e
l
e
c
t
e
d
for
f
o
r
each
e
a
c
h
class.
c
l
a
s
s
.
5
5
This
T
h
i
s
method
m
e
t
h
o
d
applies
a
p
p
l
i
e
s
to
t
o
parameters
p
a
r
a
m
e
t
e
r
s
or
o
r
variables,
v
a
r
i
a
b
l
e
s
,
values
v
a
l
u
e
s
approaching
a
p
p
r
o
a
c
h
i
n
g
and
a
n
d
crossing
c
r
o
s
s
i
n
g
the
t
h
e
boundaries
b
o
u
n
d
a
r
i
e
s
and
a
n
d
out
o
u
t
of
o
f
range
r
a
n
g
e
values.
v
a
l
u
e
s
.
©
©
Error
E
r
r
o
r
guessing
g
u
e
s
s
i
n
g
tests
t
e
s
t
s
can
c
a
n
be
b
e
based
b
a
s
e
d
on
o
n
data
d
a
t
a
collected
c
o
l
l
e
c
t
e
d
through
t
h
r
o
u
g
h
a
a
“lessons
“
l
e
s
s
o
n
s
learned”
l
e
a
r
n
e
d
”
process
p
r
o
c
e
s
s
and
a
n
d
expert
e
x
p
e
r
t
judgment.
j
u
d
g
m
e
n
t
.
10.4.5
1
0
.
4
.
5
To
T
o
evaluate
e
v
a
l
u
a
t
e
the
t
h
e
completeness
c
o
m
p
l
e
t
e
n
e
s
s
of
o
f
tests
t
e
s
t
s
and
a
n
d
to
t
o
obtain
o
b
t
a
i
n
confidence
c
o
n
f
i
d
e
n
c
e
that
t
h
a
t
there
t
h
e
r
e
is
i
s
no
n
o
unintended
u
n
i
n
t
e
n
d
e
d
functionality,
f
u
n
c
t
i
o
n
a
l
i
t
y
,
the
t
h
e
coverage
c
o
v
e
r
a
g
e
of
o
f
requirements
r
e
q
u
i
r
e
m
e
n
t
s
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
level
l
e
v
e
l
by
b
y
test
t
e
s
t
cases
c
a
s
e
s
shall
s
h
a
l
l
be
b
e
determined.
d
e
t
e
r
m
i
n
e
d
.
If
I
f
necessary,
n
e
c
e
s
s
a
r
y
,
additional
a
d
d
i
t
i
o
n
a
l
test
t
e
s
t
cases
c
a
s
e
s
shall
s
h
a
l
l
be
b
e
specified
s
p
e
c
i
f
i
e
d
or
o
r
a
a
rationale
r
a
t
i
o
n
a
l
e
shall
s
h
a
l
l
be
b
e
provided.
p
r
o
v
i
d
e
d
.
10.4.6
1
0
.
4
.
6
This
T
h
i
s
subclause
s
u
b
c
l
a
u
s
e
applies
a
p
p
l
i
e
s
to
t
o
ASIL
A
S
I
L
(A),
(
A
)
,
(B),
(
B
)
,
C
C
and
a
n
d
D,
D
,
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
4.3:
4
.
3
:
To
T
o
evaluate
e
v
a
l
u
a
t
e
the
t
h
e
completenessof
c
o
m
p
l
e
t
e
n
e
s
s
o
f
test
t
e
s
t
cases
c
a
s
e
s
andto
a
n
d
t
o
obtain
o
b
t
a
i
n
confidence
c
o
n
f
i
d
e
n
c
e
that
t
h
a
t
there
t
h
e
r
e
is
i
s
no
n
o
unintended
u
n
i
n
t
e
n
d
e
d
functionality,
f
u
n
c
t
i
o
n
a
l
i
t
y
,
the
t
h
e
stiuctural
s
t
i
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
shall
s
h
a
l
l
be
b
e
measured
m
e
a
s
u
r
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
metrics
m
e
t
r
i
c
s
listed
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
15.
1
5
.
If
I
f
the
t
h
e
achieved
a
c
h
i
e
v
e
d
structural
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
is
i
s
considered
c
o
n
s
i
d
e
r
e
d
insufficient,
i
n
s
u
f
f
i
c
i
e
n
t
,
either
e
i
t
h
e
r
additional
a
d
d
i
t
i
o
n
a
l
test
t
e
s
t
cases
c
a
s
e
s
shall
s
h
a
l
l
be
b
e
specified
s
p
e
c
i
f
i
e
d
or
o
r
a
a
rationale
r
a
t
i
o
n
a
l
e
shall
s
h
a
l
l
be
b
e
provided.
p
r
o
v
i
d
e
d
.
EXAMPLE
E
X
A
M
P
L
E
Analysis
A
n
a
l
y
s
i
s
of
o
f
structural
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
can
c
a
n
reveal
r
e
v
e
a
l
shortcomings
s
h
o
r
t
c
o
m
i
n
g
s
in
i
n
the
t
h
e
requirement-based
r
e
q
u
i
r
e
m
e
n
t
-
b
a
s
e
d
test
t
e
s
t
cases,
c
a
s
e
s
,
inadequacies
i
n
a
d
e
q
u
a
c
i
e
s
in
i
n
the
t
h
e
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
dead
d
e
a
d
code,
c
o
d
e
,
deactivated
d
e
a
c
t
i
v
a
t
e
d
code
c
o
d
e
or
o
r
unintended
u
n
i
n
t
e
n
d
e
d
functionality.
f
u
n
c
t
i
o
n
a
l
i
t
y
.
Table
T
a
b
l
e
15
1
5
—
—
Structural
S
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
metrics
m
e
t
r
i
c
s
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architecturallevel
a
r
c
h
i
t
e
c
t
u
r
a
l
l
e
v
e
l
4
4
Method
M
e
t
h
o
d
1a
1
a
refers
r
e
f
e
r
s
to
t
o
the
t
h
e
percentage
p
e
r
c
e
n
t
a
g
e
of
o
f
executed
e
x
e
c
u
t
e
d
software
s
o
f
t
w
a
r
e
functions.
f
u
n
c
t
i
o
n
s
.
This
T
h
i
s
evidence
e
v
i
d
e
n
c
e
can
c
a
n
be
b
e
achieved
a
c
h
i
e
v
e
d
by
b
y
an
a
n
appropriate
a
p
p
r
o
p
r
i
a
t
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
strategy.
s
t
r
a
t
e
g
y
.
5b
5
b
Method
M
e
t
h
o
d
1brefers
1
b
r
e
f
e
r
s
to
t
o
the
t
h
e
percentage
p
e
r
c
e
n
t
a
g
e
of
o
f
executed
e
x
e
c
u
t
e
d
software
s
o
f
t
w
a
r
e
function.
f
u
n
c
t
i
o
n
.
calls.
c
a
l
l
s
.
NOTE1_
N
O
T
E
1
_
Thestruciural
T
h
e
s
t
r
u
c
i
u
r
a
l
coverage
c
o
v
e
r
a
g
e
can
c
a
n
be
b
e
determined
d
e
t
e
r
m
i
n
e
d
using
u
s
i
n
g
appropriate
a
p
p
r
o
p
r
i
a
t
e
softwaretools.
s
o
f
t
w
a
r
e
t
o
o
l
s
.
NOTE2
N
O
T
E
2
In
I
n
the
t
h
e
case
c
a
s
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development,
d
e
v
e
l
o
p
m
e
n
t
,
software
s
o
f
t
w
a
r
e
architecture
a
r
c
h
i
t
e
c
t
u
r
e
testing
t
e
s
t
i
n
g
can
c
a
n
be
b
e
performedat
p
e
r
f
o
r
m
e
d
a
t
the
t
h
e
modellevel
m
o
d
e
l
l
e
v
e
l
using
u
s
i
n
g
analogousstructural
a
n
a
l
o
g
o
u
s
s
t
r
u
c
t
u
r
a
l
coverage
c
o
v
e
r
a
g
e
metrics
m
e
t
r
i
c
s
for
f
o
r
models.
m
o
d
e
l
s
.
10.4.7
1
0
.
4
.
7
It
I
t
shall
s
h
a
l
l
be
b
e
verified
v
e
r
i
f
i
e
d
that
t
h
a
t
the
t
h
e
embedded
e
m
b
e
d
d
e
d
softwarethatis
s
o
f
t
w
a
r
e
t
h
a
t
i
s
to
t
o
be
b
e
included
i
n
c
l
u
d
e
d
as
a
s
part
p
a
r
t
of
o
f
a
a
production
p
r
o
d
u
c
t
i
o
n
release
r
e
l
e
a
s
e
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Clause
C
l
a
u
s
e
11,
1
1
,
contains
c
o
n
t
a
i
n
s
all
a
l
l
the
t
h
e
specified
s
p
e
c
i
f
i
e
d
functions,
f
u
n
c
t
i
o
n
s
,
and
a
n
d
only
o
n
l
y
contains
c
o
n
t
a
i
n
s
other
o
t
h
e
r
unspecified
u
n
s
p
e
c
i
f
i
e
d
functionsif
f
u
n
c
t
i
o
n
s
i
f
these
t
h
e
s
e
functions
f
u
n
c
t
i
o
n
s
do
d
o
not
n
o
t
impair
i
m
p
a
i
r
the
t
h
e
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
EXAMPLE
E
X
A
M
P
L
E
In
I
n
this
t
h
i
s
context
c
o
n
t
e
x
t
unspecified
u
n
s
p
e
c
i
f
i
e
d
functions
f
u
n
c
t
i
o
n
s
include
i
n
c
l
u
d
e
code
c
o
d
e
used
u
s
e
d
for
f
o
r
debugging
d
e
b
u
g
g
i
n
g
or
o
r
instrumentation.
i
n
s
t
r
u
m
e
n
t
a
t
i
o
n
.
NOTE
N
O
T
E
If
I
f
deactivation
d
e
a
c
t
i
v
a
t
i
o
n
of
o
f
these
t
h
e
s
e
unspecified
u
n
s
p
e
c
i
f
i
e
d
functions
f
u
n
c
t
i
o
n
s
can
c
a
n
be
b
e
ensured,
e
n
s
u
r
e
d
,
this
t
h
i
s
is
i
s
an
a
n
acceptable
a
c
c
e
p
t
a
b
l
e
means
m
e
a
n
s
of
o
f
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
this
t
h
i
s
requirement.
r
e
q
u
i
r
e
m
e
n
t
.
Otherwise
O
t
h
e
r
w
i
s
e
the
t
h
e
removalof
r
e
m
o
v
a
l
o
f
such
s
u
c
h
codeis
c
o
d
e
i
s
a
a
change
c
h
a
n
g
e
(see
(
s
e
e
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
8).
8
)
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
10.4.8
1
0
.
4
.
8
The
T
h
e
test
t
e
s
t
environment
e
n
v
i
r
o
n
m
e
n
t
for
f
o
r
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
shall
s
h
a
l
l
correspond
c
o
r
r
e
s
p
o
n
d
as
a
s
closely
c
l
o
s
e
l
y
as
a
s
possible
p
o
s
s
i
b
l
e
to
t
o
the
t
h
e
target
t
a
r
g
e
t
environment.
e
n
v
i
r
o
n
m
e
n
t
.
If
I
f
the
t
h
e
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
is
i
s
not
n
o
t
carried
c
a
r
r
i
e
d
out
o
u
t
in
i
n
the
t
h
e
target
t
a
r
g
e
t
environment,
e
n
v
i
r
o
n
m
e
n
t
,
the
t
h
e
differences
d
i
f
f
e
r
e
n
c
e
s
in
i
n
the
t
h
e
source
s
o
u
r
c
e
and
a
n
d
object
o
b
j
e
c
t
code
c
o
d
e
and
a
n
d
the
t
h
e
differences
d
i
f
f
e
r
e
n
c
e
s
between
b
e
t
w
e
e
n
the
t
h
e
test
t
e
s
t
environment
e
n
v
i
r
o
n
m
e
n
t
and
a
n
d
the
t
h
e
target
t
a
r
g
e
t
environment
e
n
v
i
r
o
n
m
e
n
t
shall
s
h
a
l
l
be
b
e
analysed
a
n
a
l
y
s
e
d
in
i
n
order
o
r
d
e
r
to
t
o
specify
s
p
e
c
i
f
y
additional
a
d
d
i
t
i
o
n
a
l
tests
t
e
s
t
s
in
i
n
the
t
h
e
target
t
a
r
g
e
t
environment
e
n
v
i
r
o
n
m
e
n
t
during
d
u
r
i
n
g
the
t
h
e
subsequenttest
s
u
b
s
e
q
u
e
n
t
t
e
s
t
phases.
p
h
a
s
e
s
.
NOTE1
N
O
T
E
1
Differences
D
i
f
f
e
r
e
n
c
e
s
between
b
e
t
w
e
e
n
the
t
h
e
test
t
e
s
t
environment
e
n
v
i
r
o
n
m
e
n
t
and
a
n
d
the
t
h
e
target
t
a
r
g
e
t
environment
e
n
v
i
r
o
n
m
e
n
t
canarise
c
a
n
a
r
i
s
e
in
i
n
the
t
h
e
source
s
o
u
r
c
e
or
o
r
object
o
b
j
e
c
t
code,
c
o
d
e
,
for
f
o
r
example,
e
x
a
m
p
l
e
,
dueto
d
u
e
t
o
different
d
i
f
f
e
r
e
n
t
bit
b
i
t
widths
w
i
d
t
h
s
of
o
f
data
d
a
t
a
words
w
o
r
d
s
and
a
n
d
address
a
d
d
r
e
s
s
wordsof
w
o
r
d
s
o
f
the
t
h
e
processors.
p
r
o
c
e
s
s
o
r
s
.
NOTE2
N
O
T
E
2
Depending
D
e
p
e
n
d
i
n
g
on
o
n
the
t
h
e
scope
s
c
o
p
e
of
o
f
the
t
h
e
tests
t
e
s
t
s
and
a
n
d
the
t
h
e
hierarchical
h
i
e
r
a
r
c
h
i
c
a
l
level
l
e
v
e
l
of
o
f
integration,
i
n
t
e
g
r
a
t
i
o
n
,
the
t
h
e
appropriate
a
p
p
r
o
p
r
i
a
t
e
test
t
e
s
t
environmentsfor
e
n
v
i
r
o
n
m
e
n
t
s
f
o
r
the
t
h
e
execution
e
x
e
c
u
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
are
a
r
e
used.
u
s
e
d
.
Such
S
u
c
h
test
t
e
s
t
environments
e
n
v
i
r
o
n
m
e
n
t
s
can
c
a
n
be
b
e
the
t
h
e
target
t
a
r
g
e
t
processorfor
p
r
o
c
e
s
s
o
r
f
o
r
final
f
i
n
a
l
integration,
i
n
t
e
g
r
a
t
i
o
n
,
or
o
r
a
a
processor
p
r
o
c
e
s
s
o
r
emulator
e
m
u
l
a
t
o
r
or
o
r
a
a
development
d
e
v
e
l
o
p
m
e
n
t
system
s
y
s
t
e
m
for
f
o
r
the
t
h
e
previous
p
r
e
v
i
o
u
s
integration
i
n
t
e
g
r
a
t
i
o
n
steps.
s
t
e
p
s
.
NOTE
N
O
T
E
3
3
Software
S
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
can
c
a
n
be
b
e
executedin
e
x
e
c
u
t
e
d
i
n
different
d
i
f
f
e
r
e
n
t
environments,
e
n
v
i
r
o
n
m
e
n
t
s
,
for
f
o
r
example:
e
x
a
m
p
l
e
:
—
—
model-in-the-loop
m
o
d
e
l
-
i
n
-
t
h
e
-
l
o
o
p
tests;
t
e
s
t
s
;
—
—
software-in-the-loop
s
o
f
t
w
a
r
e
-
i
n
-
t
h
e
-
l
o
o
p
tests;
t
e
s
t
s
;
—
—
processor-in-the-loop
p
r
o
c
e
s
s
o
r
-
i
n
-
t
h
e
-
l
o
o
p
tests;
t
e
s
t
s
;
and
a
n
d
—
—
hardware-in-the-looptests.
h
a
r
d
w
a
r
e
-
i
n
-
t
h
e
-
l
o
o
p
t
e
s
t
s
.
10.5
1
0
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
10.5.1
1
0
.
5
.
1
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
10.4.1
1
0
.
4
.
1
to
t
o
10.4.6
1
0
.
4
.
6
and
a
n
d
10.4.8.
1
0
.
4
.
8
.
10.5.2
1
0
.
5
.
2
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
10.4.1,
1
0
.
4
.
1
,
10.4.2,
1
0
.
4
.
2
,
10.4.4,
1
0
.
4
.
4
,
10.4.5,
1
0
.
4
.
5
,
10.4.7
1
0
.
4
.
7
and
a
n
d
10.4.8.
1
0
.
4
.
8
.
10.5.3
1
0
.
5
.
3
Embeddedsoftwareresulting
E
m
b
e
d
d
e
d
s
o
f
t
w
a
r
e
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
10.4.1.
1
0
.
4
.
1
.
10.5.4
1
0
.
5
.
4
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
10.4.2.
1
0
.
4
.
2
.
11
1
1
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
11.1
1
1
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
objective
o
b
j
e
c
t
i
v
e
of
o
f
this
t
h
i
s
sub-phase
s
u
b
-
p
h
a
s
e
is
i
s
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
fulfils
f
u
l
f
i
l
s
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
11.2
1
1
.
2
General
G
e
n
e
r
a
l
The
T
h
e
purpose
p
u
r
p
o
s
e
of
o
f
the
t
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
is
i
s
to
t
o
demonstrate
d
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
satisfies
s
a
t
i
s
f
i
e
s
its
i
t
s
requirements
r
e
q
u
i
r
e
m
e
n
t
s
in
i
n
the
t
h
e
target
t
a
r
g
e
t
environment.
e
n
v
i
r
o
n
m
e
n
t
.
11.3
1
1
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
11.3.1
1
1
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
shall
s
h
a
l
l
be
b
e
available:
a
v
a
i
l
a
b
l
e
:
—
—
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.1;
7
.
5
.
1
;
—
—
safety
s
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
7.5.2;
7
.
5
.
2
;
—
—
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
7.5.3;
7
.
5
.
3
;
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
10.5.1:
1
0
.
5
.
1
:
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
10.5.2;
1
0
.
5
.
2
;
—
—
softwareverification
s
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
10.5.4;
1
0
.
5
.
4
;
and
a
n
d
—
—
integration
i
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
report
r
e
p
o
r
t
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-4:201
2
6
2
6
2
-
4
:
2
0
1
1,:8:5:3.
1
,
:
8
:
5
:
3
.
11.3.2
1
1
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
The
T
h
e
following
f
o
l
l
o
w
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
considered:
c
o
n
s
i
d
e
r
e
d
:
—
—
validation
v
a
l
i
d
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
6.5.3);
6
.
5
.
3
)
;
—
—
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
C551);
C
5
5
1
)
;
—
—
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Gd?)
G
d
?
)
—
—
tool
t
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
5.5.4:
5
.
5
.
4
:
and
a
n
d
—
—
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
methods
m
e
t
h
o
d
s
(from
(
f
r
o
m
external
e
x
t
e
r
n
a
l
source).
s
o
u
r
c
e
)
.
11.4
1
1
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
11.4.1
1
1
.
4
.
1
The
T
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
be
b
e
planned,
p
l
a
n
n
e
d
,
specified
s
p
e
c
i
f
i
e
d
and
a
n
d
executed
e
x
e
c
u
t
e
d
in
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9.
9
.
11.4.2
1
1
.
4
.
2
To
T
o
verify
v
e
r
i
f
y
that
t
h
a
t
the
t
h
e
embeddedsoftwarefulfils
e
m
b
e
d
d
e
d
s
o
f
t
w
a
r
e
f
u
l
f
i
l
s
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements,
r
e
q
u
i
r
e
m
e
n
t
s
,
tests
t
e
s
t
s
shall
s
h
a
l
l
be
b
e
conducted
c
o
n
d
u
c
t
e
d
in
i
n
the
t
h
e
test
t
e
s
t
environmentslisted
e
n
v
i
r
o
n
m
e
n
t
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
16.
1
6
.
NOTE
N
O
T
E
Test
T
e
s
t
casesthat
c
a
s
e
s
t
h
a
t
already
a
l
r
e
a
d
y
exist,
e
x
i
s
t
,
for
f
o
r
example
e
x
a
m
p
l
e
from
f
r
o
m
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
testing,
t
e
s
t
i
n
g
,
can
c
a
n
be
b
e
re-used.
r
e
-
u
s
e
d
.
Tabie
T
a
b
i
e
16
1
6
—
—
Test
T
e
s
t
environments
e
n
v
i
r
o
n
m
e
n
t
s
for
f
o
r
conducting
c
o
n
d
u
c
t
i
n
g
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
verification
v
e
r
i
f
i
c
a
t
i
o
n
Hardware-in-the-loop
H
a
r
d
w
a
r
e
-
i
n
-
t
h
e
-
l
o
o
p
Electronic
E
l
e
c
t
r
o
n
i
c
control
c
o
n
t
r
o
l
unit
u
n
i
t
network
n
e
t
w
o
r
k
environments?
e
n
v
i
r
o
n
m
e
n
t
s
?
Vehicles
V
e
h
i
c
l
e
s
@
@
Examplesinclude
E
x
a
m
p
l
e
s
i
n
c
l
u
d
e
test
t
e
s
t
benches
b
e
n
c
h
e
s
partially
p
a
r
t
i
a
l
l
y
or
o
r
fully
f
u
l
l
y
integrating
i
n
t
e
g
r
a
t
i
n
g
the
t
h
e
electrical
e
l
e
c
t
r
i
c
a
l
systems
s
y
s
t
e
m
s
of
o
f
a
a
vehicle,
v
e
h
i
c
l
e
,
“lab-cars”
“
l
a
b
-
c
a
r
s
”
or
o
r
“mule”
“
m
u
l
e
”
vehicles,
v
e
h
i
c
l
e
s
,
and
a
n
d
“rest
“
r
e
s
t
of
o
f
the
t
h
e
bus”
b
u
s
”
simulations.
s
i
m
u
l
a
t
i
o
n
s
.
11.4.3
1
1
.
4
.
3
The
T
h
e
testing
t
e
s
t
i
n
g
of
o
f
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
be
b
e
executed
e
x
e
c
u
t
e
d
on
o
n
the
t
h
e
target
t
a
r
g
e
t
hardware.
h
a
r
d
w
a
r
e
.
11.4.4
1
1
.
4
.
4
Theresults
T
h
e
r
e
s
u
l
t
s
of
o
f
the
t
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
shall
s
h
a
l
l
be
b
e
evaluated
e
v
a
l
u
a
t
e
d
with
w
i
t
h
regardto:
r
e
g
a
r
d
t
o
:
-
compliance
c
o
m
p
l
i
a
n
c
e
with
w
i
t
h
the
t
h
e
expected
e
x
p
e
c
t
e
d
results;
r
e
s
u
l
t
s
;
-
coverageof
c
o
v
e
r
a
g
e
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements;
r
e
q
u
i
r
e
m
e
n
t
s
;
and
a
n
d
C)
C
)
passorfail
p
a
s
s
o
r
f
a
i
l
criteria.
c
r
i
t
e
r
i
a
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
11.5
1
1
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
11.5.1
1
1
.
5
.
1
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
11.4.1
1
1
.
4
.
1
to
t
o
11.4.3.
1
1
.
4
.
3
.
11.5.2
1
1
.
5
.
2
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
11.4.1
1
1
.
4
.
1
to
t
o
11.4.3.
1
1
.
4
.
3
.
11.5.3
1
1
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
11.4.1
1
1
.
4
.
1
and
a
n
d
11.4.4.
1
1
.
4
.
4
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Annex
A
n
n
e
x
A
A
(informative)
(
i
n
f
o
r
m
a
t
i
v
e
)
Overview
O
v
e
r
v
i
e
w
of
o
f
and
a
n
d
workflow
w
o
r
k
f
l
o
w
of
o
f
managementof
m
a
n
a
g
e
m
e
n
t
o
f
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
softwarelevel
s
o
f
t
w
a
r
e
l
e
v
e
l
Table
T
a
b
l
e
A.1
A
.
1
provides
p
r
o
v
i
d
e
s
an
a
n
overview
o
v
e
r
v
i
e
w
of
o
f
objectives,
o
b
j
e
c
t
i
v
e
s
,
prerequisites
p
r
e
r
e
q
u
i
s
i
t
e
s
and
a
n
d
work
w
o
r
k
products
p
r
o
d
u
c
t
s
of
o
f
the
t
h
e
particular
p
a
r
t
i
c
u
l
a
r
phases
p
h
a
s
e
s
of
o
f
the
t
h
e
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
softwarelevel.
s
o
f
t
w
a
r
e
l
e
v
e
l
.
Table
T
a
b
l
e
A.1
A
.
1
—
—
Overview
O
v
e
r
v
i
e
w
of
o
f
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
fan
f
a
n
of
o
f
product
p
r
o
d
u
c
t
development
d
e
v
e
l
o
p
m
e
n
t
at
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
level
l
e
v
e
l
Plan
P
l
a
n
andinitiate
a
n
d
i
n
i
t
i
a
t
e
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
Project
P
r
o
j
e
c
t
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
5.5.1
5
.
5
.
1
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
safety
s
a
f
e
t
y
activities
a
c
t
i
v
i
t
i
e
s
for
f
o
r
the
t
h
e
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
5.5.1)
5
.
5
.
1
)
'
'
;
;
sub-phasesof
s
u
b
-
p
h
a
s
e
s
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
‘
‘
5.5.2
5
.
5
.
2
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
devel
d
e
v
e
l
t
t
activity.
a
c
t
i
v
i
t
y
.
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
aay
a
a
y
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
5.5.2)
5
.
5
.
2
)
Technical
T
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.1)
7
.
5
.
1
)
System
S
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.2)
7
.
5
.
2
)
5.5.3
5
.
5
.
3
Design
D
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
languages
l
a
n
g
u
a
g
e
s
5.5.4
5
.
5
.
4
Tool
T
o
o
l
application
a
p
p
l
i
c
a
t
i
o
n
guidelines
g
u
i
d
e
l
i
n
e
s
Item
I
t
e
m
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing
t
e
s
t
i
n
g
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.4)
7
.
5
.
4
)
6
6
Specification
S
p
e
c
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
Specify
S
p
e
c
i
f
y
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
The
T
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
derived
d
e
r
i
v
e
d
from
f
r
o
m
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
and
a
n
d
the
t
h
e
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification.
s
p
e
c
i
f
i
c
a
t
i
o
n
.
Detail
D
e
t
a
i
l
the
t
h
e
hardware-software
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
Verify
V
e
r
i
f
y
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
the
t
h
e
hardware-softwareinterface
h
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
i
n
t
e
r
f
a
c
e
requirements
r
e
q
u
i
r
e
m
e
n
t
s
are
a
r
e
consistent
c
o
n
s
i
s
t
e
n
t
with
w
i
t
h
the
t
h
e
technical
t
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
and
a
n
d
the
t
h
e
system
s
y
s
t
e
m
design
d
e
s
i
g
n
specification.
s
p
e
c
i
f
i
c
a
t
i
o
n
.
Technical
T
e
c
h
n
i
c
a
l
safety
s
a
f
e
t
y
concept
c
o
n
c
e
p
t
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.1)
7
.
5
.
1
)
System
S
y
s
t
e
m
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.2)
7
.
5
.
2
)
Hardware-software
H
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.6)
7
.
5
.
6
)
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
5.5.1)
5
.
5
.
1
)
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(see
(
s
e
e
5.5.2)
5
.
5
.
2
)
6.5.1
6
.
5
.
1
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
6.5.2
6
.
5
.
2
Hardware-software
H
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
6.5.3
6
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
6.5.4
6
.
5
.
4
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
7
7
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
Develop
D
e
v
e
l
o
p
a
a
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
that
t
h
a
t
realizes
r
e
a
l
i
z
e
s
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
Verify
V
e
r
i
f
y
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
5.5.1)
5
.
5
.
1
)
Design
D
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
languages(see
l
a
n
g
u
a
g
e
s
(
s
e
e
5.5.3)
5
.
5
.
3
)
design.
d
e
s
i
g
n
.
|
|
Hardware-software
H
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
|
|
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
7.5.6)
7
.
5
.
6
)
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
7.5.1
7
.
5
.
1
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
7.5.2
7
.
5
.
2
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
7.5.3
7
.
5
.
3
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
7.5.4
7
.
5
.
4
Safety
S
a
f
e
t
y
analysis
a
n
a
l
y
s
i
s
report
r
e
p
o
r
t
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
6.5.1)
6
.
5
.
1
)
7.5.5
7
.
5
.
5
Dependentfailures
D
e
p
e
n
d
e
n
t
f
a
i
l
u
r
e
s
analysis
a
n
a
l
y
s
i
s
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
6.5.3)
6
.
5
.
3
)
report
r
e
p
o
r
t
7.5.6
7
.
5
.
6
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
6.5.4)
6
.
5
.
4
)
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Table
T
a
b
l
e
A.1
A
.
1
(continued)
(
c
o
n
t
i
n
u
e
d
)
slices
s
l
i
c
e
s
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementa-
i
m
p
l
e
m
e
n
t
a
-
tion
t
i
o
n
Specify
S
p
e
c
i
f
y
the
t
h
e
software
s
o
f
t
w
a
r
e
unitsin
u
n
i
t
s
i
n
accordancewith
a
c
c
o
r
d
a
n
c
e
w
i
t
h
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
and
a
n
d
the
t
h
e
associated
a
s
s
o
c
i
a
t
e
d
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
Implement
I
m
p
l
e
m
e
n
t
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
as
a
s
specified.
s
p
e
c
i
f
i
e
d
.
Static
S
t
a
t
i
c
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
their
t
h
e
i
r
implementation.
i
m
p
l
e
m
e
n
t
a
t
i
o
n
.
Design
D
e
s
i
g
n
and
a
n
d
coding
c
o
d
i
n
g
guidelines
g
u
i
d
e
l
i
n
e
s
for
f
o
r
8.5.1
8
.
5
.
1
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
programming
p
r
o
g
r
a
m
m
i
n
g
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
anguayeS
a
n
g
u
a
y
e
S
see
s
e
e
Oo)
O
o
)
8.5.2
8
.
5
.
2
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
6.5.3)
6
.
5
.
3
)
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
(refined)
(
r
e
f
i
n
e
d
)
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
7.5.1)
7
.
5
.
1
)
8.5.3
8
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.2)
7
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.3)
7
.
5
.
3
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.6)
7
.
5
.
6
)
9
9
Softwareunit
S
o
f
t
w
a
r
e
u
n
i
t
testing
t
e
s
t
i
n
g
Demonstrate
D
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
units
u
n
i
t
s
fulfil
f
u
l
f
i
l
the
t
h
e
software
s
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specifications
s
p
e
c
i
f
i
c
a
t
i
o
n
s
and
a
n
d
do
d
o
not
n
o
t
contain
c
o
n
t
a
i
n
undesired
u
n
d
e
s
i
r
e
d
functionality.
f
u
n
c
t
i
o
n
a
l
i
t
y
.
Hardware-software
H
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
6.5.2)
6
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
6.5.3)
6
.
5
.
3
)
9.5.1
9
.
5
.
1
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
9.5.2
9
.
5
.
2
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.2)
7
.
5
.
2
)
9.5.3
9
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
Cement
C
e
m
e
n
t
(see
(
s
e
e
8.5.1)
8
.
5
.
1
)
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
(see
(
s
e
e
8.5.2)
8
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
8.5.3)
8
.
5
.
3
)
integration
i
n
t
e
g
r
a
t
i
o
n
andtesting
a
n
d
t
e
s
t
i
n
g
Integrate
I
n
t
e
g
r
a
t
e
the
t
h
e
software
s
o
f
t
w
a
r
e
elements.
e
l
e
m
e
n
t
s
.
Demonstrate
D
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
software
s
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
is
i
s
realized
r
e
a
l
i
z
e
d
by
b
y
the
t
h
e
embeddedsoftware.
e
m
b
e
d
d
e
d
s
o
f
t
w
a
r
e
.
Hardware-software
H
a
r
d
w
a
r
e
-
s
o
f
t
w
a
r
e
interface
i
n
t
e
r
f
a
c
e
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(6.5.2)
(
6
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
7.5.1)
7
.
5
.
1
)
10.5.1
1
0
.
5
.
1
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
10.5.2
1
0
.
5
.
2
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.2)
7
.
5
.
2
)
10.5.3
1
0
.
5
.
3
Embedded
E
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
Software
S
o
f
t
w
a
r
e
unit
u
n
i
t
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
(see
(
s
e
e
8.5.2)
8
.
5
.
2
)
10.5.4
1
0
.
5
.
4
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
9.5.1)
9
.
5
.
1
)
Softwareverification
S
o
f
t
w
a
r
e
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
9.5.2)
9
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
9.5.3)
9
.
5
.
3
)
11
1
1
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
Demonstrate
D
e
m
o
n
s
t
r
a
t
e
that
t
h
a
t
the
t
h
e
embedded
e
m
b
e
d
d
e
d
softwarefulfils
s
o
f
t
w
a
r
e
f
u
l
f
i
l
s
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements.
r
e
q
u
i
r
e
m
e
n
t
s
.
Software
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design
d
e
s
i
g
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(see
(
s
e
e
7.5.1)
7
.
5
.
1
)
11.5.1
1
1
.
5
.
1
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.2)
7
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements
r
e
q
u
i
r
e
m
e
n
t
s
11.5.2
1
1
.
5
.
2
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
7.5.3)
7
.
5
.
3
)
11.5.3
1
1
.
5
.
3
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
fined
f
i
n
e
d
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
irene)
i
r
e
n
e
)
(see
(
s
e
e
10.5.1)
1
0
.
5
.
1
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
10.5.2)
1
0
.
5
.
2
)
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
(refined)
(
r
e
f
i
n
e
d
)
(see
(
s
e
e
10.5.4)
1
0
.
5
.
4
)
Integration
I
n
t
e
g
r
a
t
i
o
n
testing
t
e
s
t
i
n
g
report
r
e
p
o
r
t
(see
(
s
e
e
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
8.5.2)
8
.
5
.
2
)
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Table
T
a
b
l
e
A.1
A
.
1
(continued)
(
c
o
n
t
i
n
u
e
d
)
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
Annex
A
n
n
e
x
C
C
Enable
E
n
a
b
l
e
controlled
c
o
n
t
r
o
l
l
e
d
changesin
c
h
a
n
g
e
s
i
n
the
t
h
e
See
S
e
e
applicable
a
p
p
l
i
c
a
b
l
e
prerequisites
p
r
e
r
e
q
u
i
s
i
t
e
s
of
o
f
behaviour
b
e
h
a
v
i
o
u
r
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
for
f
o
r
the
t
h
e
relevant.phasesof
r
e
l
e
v
a
n
t
.
p
h
a
s
e
s
o
f
the
t
h
e
safety
s
a
f
e
t
y
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
different
d
i
f
f
e
r
e
n
t
applications
a
p
p
l
i
c
a
t
i
o
n
s
lifecycle
l
i
f
e
c
y
c
l
e
in
i
n
which
w
h
i
c
h
software
s
o
f
t
w
a
r
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
is
i
s
applied.
a
p
p
l
i
e
d
.
C.5.1
C
.
5
.
1
Configuration
C
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
C.5.2
C
.
5
.
2
Calibration
C
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
C.5.3
C
.
5
.
3
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
C.5.4
C
.
5
.
4
Configuration
C
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
C.5.5
C
.
5
.
5
Calibration
C
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
C.5.6
C
.
5
.
6
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
C.5.7
C
.
5
.
7
Verification
V
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
C.5.8
C
.
5
.
8
Verification
V
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Annex
A
n
n
e
x
B
B
(informative)
(
i
n
f
o
r
m
a
t
i
v
e
)
Model-based
M
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
B.1
B
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
This
T
h
i
s
annex
a
n
n
e
x
describes
d
e
s
c
r
i
b
e
s
the
t
h
e
concept
c
o
n
c
e
p
t
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
of
o
f
in-vehicle
i
n
-
v
e
h
i
c
l
e
software
s
o
f
t
w
a
r
e
and
a
n
d
outlines
o
u
t
l
i
n
e
s
its
i
t
s
implications
i
m
p
l
i
c
a
t
i
o
n
s
on
o
n
the
t
h
e
product
p
r
o
d
u
c
t
developmentat
d
e
v
e
l
o
p
m
e
n
t
a
t
the
t
h
e
softwarelevel.
s
o
f
t
w
a
r
e
l
e
v
e
l
.
B.2
B
.
2
General
G
e
n
e
r
a
l
Mathematical
M
a
t
h
e
m
a
t
i
c
a
l
modelling,
m
o
d
e
l
l
i
n
g
,
which
w
h
i
c
h
has
h
a
s
been
b
e
e
n
extensively
e
x
t
e
n
s
i
v
e
l
y
used
u
s
e
d
in
i
n
many
m
a
n
y
engineering
e
n
g
i
n
e
e
r
i
n
g
domains,
d
o
m
a
i
n
s
,
is
i
s
also
a
l
s
o
gaining
g
a
i
n
i
n
g
widespread
w
i
d
e
s
p
r
e
a
d
use
u
s
e
in
i
n
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
of
o
f
embedded
e
m
b
e
d
d
e
d
software.
s
o
f
t
w
a
r
e
.
In
I
n
the
t
h
e
automotive
a
u
t
o
m
o
t
i
v
e
sector,
s
e
c
t
o
r
,
modelling
m
o
d
e
l
l
i
n
g
is
i
s
used
u
s
e
d
for
f
o
r
the
t
h
e
conceptual
c
o
n
c
e
p
t
u
a
l
capture
c
a
p
t
u
r
e
of
o
f
the
t
h
e
functionality
f
u
n
c
t
i
o
n
a
l
i
t
y
to
t
o
be
b
e
realized
r
e
a
l
i
z
e
d
(open/closed
(
o
p
e
n
/
c
l
o
s
e
d
loop
l
o
o
p
control,
c
o
n
t
r
o
l
,
monitoring)
m
o
n
i
t
o
r
i
n
g
)
as
a
s
well
w
e
l
l
as
a
s
for
f
o
r
the
t
h
e
simulation
s
i
m
u
l
a
t
i
o
n
of
o
f
real
r
e
a
l
physical
p
h
y
s
i
c
a
l
system
s
y
s
t
e
m
behaviours
b
e
h
a
v
i
o
u
r
s
(vehicle
(
v
e
h
i
c
l
e
environment).
e
n
v
i
r
o
n
m
e
n
t
)
.
Modelling
M
o
d
e
l
l
i
n
g
is
i
s
usually
u
s
u
a
l
l
y
carried
c
a
r
r
i
e
d
out
o
u
t
with
w
i
t
h
commercial
c
o
m
m
e
r
c
i
a
l
off-the-shelf
o
f
f
-
t
h
e
-
s
h
e
l
f
modelling
m
o
d
e
l
l
i
n
g
and
a
n
d
simulation
s
i
m
u
l
a
t
i
o
n
software
s
o
f
t
w
a
r
e
tools.
t
o
o
l
s
.
They
T
h
e
y
support
s
u
p
p
o
r
t
the
t
h
e
developmentand
d
e
v
e
l
o
p
m
e
n
t
a
n
d
definition
d
e
f
i
n
i
t
i
o
n
of
o
f
system/software
s
y
s
t
e
m
/
s
o
f
t
w
a
r
e
elements,
e
l
e
m
e
n
t
s
,
and
a
n
d
their
t
h
e
i
r
connections
c
o
n
n
e
c
t
i
o
n
s
and
a
n
d
interfaces
i
n
t
e
r
f
a
c
e
s
by
b
y
semi-formal
s
e
m
i
-
f
o
r
m
a
l
graphical
g
r
a
p
h
i
c
a
l
models.
m
o
d
e
l
s
.
These
T
h
e
s
e
models
m
o
d
e
l
s
employ
e
m
p
l
o
y
editable,
e
d
i
t
a
b
l
e
,
hierarchical
h
i
e
r
a
r
c
h
i
c
a
l
block
b
l
o
c
k
diagrams
d
i
a
g
r
a
m
s
(e.g.
(
e
.
g
.
control
c
o
n
t
r
o
l
diagrams)
d
i
a
g
r
a
m
s
)
and
a
n
d
extended
e
x
t
e
n
d
e
d
state
s
t
a
t
e
transition
t
r
a
n
s
i
t
i
o
n
diagrams
d
i
a
g
r
a
m
s
(e.g.
(
e
.
g
.
state
s
t
a
t
e
charts).
c
h
a
r
t
s
)
.
The
T
h
e
software
s
o
f
t
w
a
r
e
tools
t
o
o
l
s
provide
p
r
o
v
i
d
e
the
t
h
e
necessary
n
e
c
e
s
s
a
r
y
meansof
m
e
a
n
s
o
f
description,
d
e
s
c
r
i
p
t
i
o
n
,
computation
c
o
m
p
u
t
a
t
i
o
n
techniques
t
e
c
h
n
i
q
u
e
s
and
a
n
d
interpreters/compilers.
i
n
t
e
r
p
r
e
t
e
r
s
/
c
o
m
p
i
l
e
r
s
.
Graphical
G
r
a
p
h
i
c
a
l
editors
e
d
i
t
o
r
s
permit
p
e
r
m
i
t
an
a
n
intuitive
i
n
t
u
i
t
i
v
e
development
d
e
v
e
l
o
p
m
e
n
t
and
a
n
d
description
d
e
s
c
r
i
p
t
i
o
n
of
o
f
complex
c
o
m
p
l
e
x
models.
m
o
d
e
l
s
.
Hierarchically
H
i
e
r
a
r
c
h
i
c
a
l
l
y
structured
s
t
r
u
c
t
u
r
e
d
modularity
m
o
d
u
l
a
r
i
t
y
is
i
s
used
u
s
e
d
in
i
n
order
o
r
d
e
r
to
t
o
control
c
o
n
t
r
o
l
complexity.
c
o
m
p
l
e
x
i
t
y
.
A
A
model
m
o
d
e
l
consists
c
o
n
s
i
s
t
s
of
o
f
function
f
u
n
c
t
i
o
n
blocks
b
l
o
c
k
s
with
w
i
t
h
well-defined
w
e
l
l
-
d
e
f
i
n
e
d
inputs
i
n
p
u
t
s
and
a
n
d
outputs.
o
u
t
p
u
t
s
.
Function
F
u
n
c
t
i
o
n
blocks
b
l
o
c
k
s
are
a
r
e
connected
c
o
n
n
e
c
t
e
d
within
w
i
t
h
i
n
the
t
h
e
block
b
l
o
c
k
diagram
d
i
a
g
r
a
m
by
b
y
directed
d
i
r
e
c
t
e
d
edges
e
d
g
e
s
between
b
e
t
w
e
e
n
their
t
h
e
i
r
interfaces,
i
n
t
e
r
f
a
c
e
s
,
which
w
h
i
c
h
describe
d
e
s
c
r
i
b
e
signal
s
i
g
n
a
l
flows.
f
l
o
w
s
.
With
W
i
t
h
this,
t
h
i
s
,
they
t
h
e
y
represent
r
e
p
r
e
s
e
n
t
equations
e
q
u
a
t
i
o
n
s
in
i
n
the
t
h
e
mathematical
m
a
t
h
e
m
a
t
i
c
a
l
model,
m
o
d
e
l
,
which
w
h
i
c
h
relate
r
e
l
a
t
e
the
t
h
e
interface
i
n
t
e
r
f
a
c
e
variables
v
a
r
i
a
b
l
e
s
of
o
f
different
d
i
f
f
e
r
e
n
t
elements.
e
l
e
m
e
n
t
s
.
The
T
h
e
connection
c
o
n
n
e
c
t
i
o
n
lines
l
i
n
e
s
represent
r
e
p
r
e
s
e
n
t
causally
c
a
u
s
a
l
l
y
motivated
m
o
t
i
v
a
t
e
d
directions
d
i
r
e
c
t
i
o
n
s
of
o
f
action,
a
c
t
i
o
n
,
which
w
h
i
c
h
define
d
e
f
i
n
e
the
t
h
e
outputs
o
u
t
p
u
t
s
of
o
f
one
o
n
e
block
b
l
o
c
k
as
a
s
the
t
h
e
inputs
i
n
p
u
t
s
of
o
f
another.
a
n
o
t
h
e
r
.
Other
O
t
h
e
r
tool-specific
t
o
o
l
-
s
p
e
c
i
f
i
c
modelling
m
o
d
e
l
l
i
n
g
semantics
s
e
m
a
n
t
i
c
s
also
a
l
s
o
can
c
a
n
be
b
e
used
u
s
e
d
to
t
o
impose
i
m
p
o
s
e
order
o
r
d
e
r
of
o
f
execution
e
x
e
c
u
t
i
o
n
and
a
n
d
timing.
t
i
m
i
n
g
.
The
T
h
e
hierarchy
h
i
e
r
a
r
c
h
y
of
o
f
elements
e
l
e
m
e
n
t
s
can
c
a
n
contain
c
o
n
t
a
i
n
several
s
e
v
e
r
a
l
levels
l
e
v
e
l
s
of
o
f
refinement.
r
e
f
i
n
e
m
e
n
t
.
Such
S
u
c
h
models
m
o
d
e
l
s
can
c
a
n
be
b
e
simulated,
s
i
m
u
l
a
t
e
d
,
i.e.
i
.
e
.
executed.
e
x
e
c
u
t
e
d
.
During
D
u
r
i
n
g
simulation
s
i
m
u
l
a
t
i
o
n
the
t
h
e
calculation
c
a
l
c
u
l
a
t
i
o
n
causality
c
a
u
s
a
l
i
t
y
follows
f
o
l
l
o
w
s
the
t
h
e
defined
d
e
f
i
n
e
d
directions
d
i
r
e
c
t
i
o
n
s
of
o
f
action
a
c
t
i
o
n
until
u
n
t
i
l
the
t
h
e
entire
e
n
t
i
r
e
model
m
o
d
e
l
has
h
a
s
been
b
e
e
n
processed.
p
r
o
c
e
s
s
e
d
.
There
T
h
e
r
e
is
i
s
a
a
range
r
a
n
g
e
ofdifferent
o
f
d
i
f
f
e
r
e
n
t
solvers
s
o
l
v
e
r
s
available
a
v
a
i
l
a
b
l
e
for
f
o
r
solving
s
o
l
v
i
n
g
the
t
h
e
equations
e
q
u
a
t
i
o
n
s
described
d
e
s
c
r
i
b
e
d
by
b
y
the
t
h
e
model.
m
o
d
e
l
.
Variable-step
V
a
r
i
a
b
l
e
-
s
t
e
p
solvers
s
o
l
v
e
r
s
are
a
r
e
used
u
s
e
d
primarily
p
r
i
m
a
r
i
l
y
for
f
o
r
modelling
m
o
d
e
l
l
i
n
g
the
t
h
e
vehicle
v
e
h
i
c
l
e
and
a
n
d
the
t
h
e
environment.
e
n
v
i
r
o
n
m
e
n
t
.
For
F
o
r
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
of
o
f
embedded
e
m
b
e
d
d
e
d
software,
s
o
f
t
w
a
r
e
,
fixed-step
f
i
x
e
d
-
s
t
e
p
solvers
s
o
l
v
e
r
s
are
a
r
e
used,
u
s
e
d
,
which
w
h
i
c
h
represent
r
e
p
r
e
s
e
n
t
a
a
necessary
n
e
c
e
s
s
a
r
y
prerequisite
p
r
e
r
e
q
u
i
s
i
t
e
for
f
o
r
efficient
e
f
f
i
c
i
e
n
t
code
c
o
d
e
generation.
g
e
n
e
r
a
t
i
o
n
.
The
T
h
e
modelling
m
o
d
e
l
l
i
n
g
style
s
t
y
l
e
described
d
e
s
c
r
i
b
e
d
is
i
s
used
u
s
e
d
extensively
e
x
t
e
n
s
i
v
e
l
y
within
w
i
t
h
i
n
the
t
h
e
scope
s
c
o
p
e
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
of
o
f
embedded
e
m
b
e
d
d
e
d
in-vehicle
i
n
-
v
e
h
i
c
l
e
software.
s
o
f
t
w
a
r
e
.
Typically,
T
y
p
i
c
a
l
l
y
,
both
b
o
t
h
an
a
n
executable
e
x
e
c
u
t
a
b
l
e
modelof
m
o
d
e
l
o
f
the
t
h
e
control
c
o
n
t
r
o
l
software
s
o
f
t
w
a
r
e
(e.g.
(
e
.
g
.
a
a
functional
f
u
n
c
t
i
o
n
a
l
model)
m
o
d
e
l
)
and
a
n
d
a
a
model
m
o
d
e
l
of
o
f
the
t
h
e
surrounding
s
u
r
r
o
u
n
d
i
n
g
system
s
y
s
t
e
m
(e.g.
(
e
.
g
.
a
a
vehicle
v
e
h
i
c
l
e
model)
m
o
d
e
l
)
and
a
n
d
its
i
t
s
environment(e.g.
e
n
v
i
r
o
n
m
e
n
t
(
e
.
g
.
an
a
n
environment
e
n
v
i
r
o
n
m
e
n
t
model)
m
o
d
e
l
)
are
a
r
e
created
c
r
e
a
t
e
d
early
e
a
r
l
y
in
i
n
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
cycle
c
y
c
l
e
and
a
n
d
are
a
r
e
simulated
s
i
m
u
l
a
t
e
d
together.
t
o
g
e
t
h
e
r
.
This
T
h
i
s
way,
w
a
y
,
it
i
t
is
i
s
possible
p
o
s
s
i
b
l
e
to
t
o
model
m
o
d
e
l
even
e
v
e
n
highly
h
i
g
h
l
y
complex
c
o
m
p
l
e
x
automotive
a
u
t
o
m
o
t
i
v
e
systems
s
y
s
t
e
m
s
with
w
i
t
h
a
a
high
h
i
g
h
degree
d
e
g
r
e
e
of
o
f
detail
d
e
t
a
i
l
at
a
t
an
a
n
acceptable
a
c
c
e
p
t
a
b
l
e
calculation
c
a
l
c
u
l
a
t
i
o
n
speed
s
p
e
e
d
and
a
n
d
to
t
o
simulate
s
i
m
u
l
a
t
e
their
t
h
e
i
r
behaviour
b
e
h
a
v
i
o
u
r
close
c
l
o
s
e
to
t
o
reality.
r
e
a
l
i
t
y
.
While
W
h
i
l
e
the
t
h
e
vehicle/environment
v
e
h
i
c
l
e
/
e
n
v
i
r
o
n
m
e
n
t
modelis
m
o
d
e
l
i
s
gradually
g
r
a
d
u
a
l
l
y
replaced
r
e
p
l
a
c
e
d
during
d
u
r
i
n
g
the
t
h
e
course
c
o
u
r
s
e
of
o
f
development
d
e
v
e
l
o
p
m
e
n
t
by
b
y
the
t
h
e
real
r
e
a
l
system
s
y
s
t
e
m
and
a
n
d
its
i
t
s
real
r
e
a
l
environment,
e
n
v
i
r
o
n
m
e
n
t
,
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
model
m
o
d
e
l
can
c
a
n
serve
s
e
r
v
e
as
a
s
a
a
blueprint
b
l
u
e
p
r
i
n
t
for
f
o
r
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
of
o
f
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
on
o
n
the
t
h
e
control
c
o
n
t
r
o
l
unit
u
n
i
t
through
t
h
r
o
u
g
h
code
c
o
d
e
generation.
g
e
n
e
r
a
t
i
o
n
.
One
O
n
e
characteristic
c
h
a
r
a
c
t
e
r
i
s
t
i
c
of
o
f
the
t
h
e
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
paradigm
p
a
r
a
d
i
g
m
is
i
s
the
t
h
e
fact
f
a
c
t
that
t
h
a
t
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
model
m
o
d
e
l
not
n
o
t
only
o
n
l
y
specifies
s
p
e
c
i
f
i
e
s
the
t
h
e
desired
d
e
s
i
r
e
d
function
f
u
n
c
t
i
o
n
but
b
u
t
also
a
l
s
o
provides
p
r
o
v
i
d
e
s
design
d
e
s
i
g
n
information
i
n
f
o
r
m
a
t
i
o
n
and
a
n
d
finally
f
i
n
a
l
l
y
even
e
v
e
n
serves
s
e
r
v
e
s
asthe
a
s
t
h
e
basis
b
a
s
i
s
of
o
f
the
t
h
e
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
by
b
y
means
m
e
a
n
s
of
o
f
code
c
o
d
e
generation.
g
e
n
e
r
a
t
i
o
n
.
In
I
n
other
o
t
h
e
r
words,
w
o
r
d
s
,
such
s
u
c
h
a
a
functional
f
u
n
c
t
i
o
n
a
l
model
m
o
d
e
l
represents
r
e
p
r
e
s
e
n
t
s
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
aspects
a
s
p
e
c
t
s
as
a
s
well
w
e
l
l
as
a
s
design
d
e
s
i
g
n
and
a
n
d
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
aspects.
a
s
p
e
c
t
s
.
In
I
n
practice,
p
r
a
c
t
i
c
e
,
these
t
h
e
s
e
different
d
i
f
f
e
r
e
n
t
aspects
a
s
p
e
c
t
s
are
a
r
e
reflected
r
e
f
l
e
c
t
e
d
in
i
n
an
a
n
evolution
e
v
o
l
u
t
i
o
n
of
o
f
the
t
h
e
functional
f
u
n
c
t
i
o
n
a
l
model
m
o
d
e
l
from
f
r
o
m
an
a
n
early
e
a
r
l
y
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
model
m
o
d
e
l
via
v
i
a
a
a
design
d
e
s
i
g
n
model
m
o
d
e
l
to
t
o
an
a
n
implementation
i
m
p
l
e
m
e
n
t
a
t
i
o
n
model
m
o
d
e
l
and
a
n
d
finally
f
i
n
a
l
l
y
its
i
t
s
automatic
a
u
t
o
m
a
t
i
c
transformation
t
r
a
n
s
f
o
r
m
a
t
i
o
n
into
i
n
t
o
code
c
o
d
e
(model
(
m
o
d
e
l
evolution).
e
v
o
l
u
t
i
o
n
)
.
In
I
n
comparison
c
o
m
p
a
r
i
s
o
n
to
t
o
code-based
c
o
d
e
-
b
a
s
e
d
software
s
o
f
t
w
a
r
e
developmentwith
d
e
v
e
l
o
p
m
e
n
t
w
i
t
h
a
a
clear
c
l
e
a
r
separation
s
e
p
a
r
a
t
i
o
n
of
o
f
phases,
p
h
a
s
e
s
,
in
i
n
model-based
m
o
d
e
l
-
b
a
s
e
d
developmenta
d
e
v
e
l
o
p
m
e
n
t
a
stronger
s
t
r
o
n
g
e
r
coalescence
c
o
a
l
e
s
c
e
n
c
e
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
of
o
f
the
t
h
e
phases
p
h
a
s
e
s
“Software
“
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements”,
r
e
q
u
i
r
e
m
e
n
t
s
”
,
“Software
“
S
o
f
t
w
a
r
e
architectural
a
r
c
h
i
t
e
c
t
u
r
a
l
design”
d
e
s
i
g
n
”
and
a
n
d
“Software
“
S
o
f
t
w
a
r
e
unit
u
n
i
t
design
d
e
s
i
g
n
and
a
n
d
implementation”
i
m
p
l
e
m
e
n
t
a
t
i
o
n
”
can
c
a
n
be
b
e
noted.
n
o
t
e
d
.
Moreover,
M
o
r
e
o
v
e
r
,
one
o
n
e
and
a
n
d
the
t
h
e
same
s
a
m
e
graphical
g
r
a
p
h
i
c
a
l
modelling
m
o
d
e
l
l
i
n
g
notation
n
o
t
a
t
i
o
n
is
i
s
used
u
s
e
d
during
d
u
r
i
n
g
the
t
h
e
consecutive
c
o
n
s
e
c
u
t
i
v
e
development
d
e
v
e
l
o
p
m
e
n
t
stages.
s
t
a
g
e
s
.
Verification
V
e
r
i
f
i
c
a
t
i
o
n
activities
a
c
t
i
v
i
t
i
e
s
can
c
a
n
also
a
l
s
o
be
b
e
treated
t
r
e
a
t
e
d
differently
d
i
f
f
e
r
e
n
t
l
y
since
s
i
n
c
e
models
m
o
d
e
l
s
can
c
a
n
be
b
e
used
u
s
e
d
as
a
s
a
a
useful
u
s
e
f
u
l
source
s
o
u
r
c
e
of
o
f
information
i
n
f
o
r
m
a
t
i
o
n
for
f
o
r
the
t
h
e
testing
t
e
s
t
i
n
g
process
p
r
o
c
e
s
s
(e.g.
(
e
.
g
.
model-based
m
o
d
e
l
-
b
a
s
e
d
testing),
t
e
s
t
i
n
g
)
,
or
o
r
can
c
a
n
serve
s
e
r
v
e
as
a
s
the
t
h
e
object
o
b
j
e
c
t
to
t
o
be
b
e
verified.
v
e
r
i
f
i
e
d
.
The
T
h
e
seamlessutilization
s
e
a
m
l
e
s
s
u
t
i
l
i
z
a
t
i
o
n
of
o
f
models
m
o
d
e
l
s
facilitates
f
a
c
i
l
i
t
a
t
e
s
highly
h
i
g
h
l
y
consistent
c
o
n
s
i
s
t
e
n
t
and
a
n
d
efficient
e
f
f
i
c
i
e
n
t
development.
d
e
v
e
l
o
p
m
e
n
t
.
NOTE
N
O
T
E
The
T
h
e
paradigm
p
a
r
a
d
i
g
m
of
o
f
model-based
m
o
d
e
l
-
b
a
s
e
d
development
d
e
v
e
l
o
p
m
e
n
t
does
d
o
e
s
not
n
o
t
depend
d
e
p
e
n
d
on
o
n
the
t
h
e
existence
e
x
i
s
t
e
n
c
e
of
o
f
the
t
h
e
model
m
o
d
e
l
type
t
y
p
e
mentioned
m
e
n
t
i
o
n
e
d
above.
a
b
o
v
e
.
Alternative
A
l
t
e
r
n
a
t
i
v
e
models
m
o
d
e
l
s
such
s
u
c
h
as
a
s
UML
U
M
L
can
c
a
n
beused.
b
e
u
s
e
d
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Annex
A
n
n
e
x
C
C
(normative)
(
n
o
r
m
a
t
i
v
e
)
Software
S
o
f
t
w
a
r
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
C.1
C
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
objective
o
b
j
e
c
t
i
v
e
of
o
f
software
s
o
f
t
w
a
r
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
is
i
s
to
t
o
enable
e
n
a
b
l
e
controlled
c
o
n
t
r
o
l
l
e
d
changes
c
h
a
n
g
e
s
in
i
n
the
t
h
e
behaviour
b
e
h
a
v
i
o
u
r
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
for
f
o
r
different
d
i
f
f
e
r
e
n
t
applications.
a
p
p
l
i
c
a
t
i
o
n
s
.
C.2
C
.
2
General
G
e
n
e
r
a
l
description
d
e
s
c
r
i
p
t
i
o
n
Configurable
C
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
enables
e
n
a
b
l
e
s
the
t
h
e
development
d
e
v
e
l
o
p
m
e
n
t
of
o
f
application
a
p
p
l
i
c
a
t
i
o
n
specific
s
p
e
c
i
f
i
c
software
s
o
f
t
w
a
r
e
using
u
s
i
n
g
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
and
a
n
d
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
(see
(
s
e
e
Figure
F
i
g
u
r
e
C.1).
C
.
1
)
.
Figure
F
i
g
u
r
e
C.1
C
.
1
—
—
Creating
C
r
e
a
t
i
n
g
application
a
p
p
l
i
c
a
t
i
o
n
specific
s
p
e
c
i
f
i
c
software
s
o
f
t
w
a
r
e
C.3
C
.
3
Inputs
I
n
p
u
t
s
to
t
o
this
t
h
i
s
clause
c
l
a
u
s
e
C.3.1
C
.
3
.
1
Prerequisites
P
r
e
r
e
q
u
i
s
i
t
e
s
The
T
h
e
prerequisites
p
r
e
r
e
q
u
i
s
i
t
e
s
are
a
r
e
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
the
t
h
e
relevant
r
e
l
e
v
a
n
t
phasesin
p
h
a
s
e
s
i
n
which
w
h
i
c
h
software
s
o
f
t
w
a
r
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
is
i
s
applied.
a
p
p
l
i
e
d
.
C.3.2
C
.
3
.
2
Further
F
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
See
S
e
e
applicable
a
p
p
l
i
c
a
b
l
e
further
f
u
r
t
h
e
r
supporting
s
u
p
p
o
r
t
i
n
g
information
i
n
f
o
r
m
a
t
i
o
n
of
o
f
the
t
h
e
relevant
r
e
l
e
v
a
n
t
phases
p
h
a
s
e
s
in
i
n
which
w
h
i
c
h
software
s
o
f
t
w
a
r
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
is
i
s
applied.
a
p
p
l
i
e
d
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
C.4
C
.
4
Requirements
R
e
q
u
i
r
e
m
e
n
t
s
and
a
n
d
recommendations
r
e
c
o
m
m
e
n
d
a
t
i
o
n
s
C.4.1
C
.
4
.
1
The
T
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
be
b
e
specified
s
p
e
c
i
f
i
e
d
to
t
o
ensure
e
n
s
u
r
e
the
t
h
e
correct
c
o
r
r
e
c
t
usage
u
s
a
g
e
of
o
f
the
t
h
e
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
during
d
u
r
i
n
g
the
t
h
e
safety
s
a
f
e
t
y
lifecycle.
l
i
f
e
c
y
c
l
e
.
This
T
h
i
s
shall
s
h
a
l
l
include:
i
n
c
l
u
d
e
:
©
©
)
)
the
t
h
e
valid
v
a
l
i
d
values
v
a
l
u
e
s
of
o
f
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data;
d
a
t
a
;
Ay
A
y
)
)
the
t
h
e
intent
i
n
t
e
n
t
and
a
n
d
usage
u
s
a
g
e
of
o
f
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data;
d
a
t
a
;
9
9
)
)
the
t
h
e
range,scaling,
r
a
n
g
e
,
s
c
a
l
i
n
g
,
units;
u
n
i
t
s
;
and
a
n
d
Qa
Q
a
)
)
the
t
h
e
interdependencies
i
n
t
e
r
d
e
p
e
n
d
e
n
c
i
e
s
betweendifferent
b
e
t
w
e
e
n
d
i
f
f
e
r
e
n
t
elements
e
l
e
m
e
n
t
s
of
o
f
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data.
d
a
t
a
.
C.4.2
C
.
4
.
2
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
be
b
e
performed
p
e
r
f
o
r
m
e
d
to
t
o
ensure:
e
n
s
u
r
e
:
-
the
t
h
e
use
u
s
e
of
o
f
values
v
a
l
u
e
s
within
w
i
t
h
i
n
their
t
h
e
i
r
specified
s
p
e
c
i
f
i
e
d
range;
r
a
n
g
e
;
and
a
n
d
-
the
t
h
e
compatibility
c
o
m
p
a
t
i
b
i
l
i
t
y
with
w
i
t
h
the
t
h
e
other
o
t
h
e
r
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data.
d
a
t
a
.
NOTE
N
O
T
E
The
T
h
e
testing
t
e
s
t
i
n
g
of
o
f
the
t
h
e
configured
c
o
n
f
i
g
u
r
e
d
software
s
o
f
t
w
a
r
e
is
i
s
performed
p
e
r
f
o
r
m
e
d
within
w
i
t
h
i
n
the
t
h
e
test
t
e
s
t
phases
p
h
a
s
e
s
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
lifecycle
l
i
f
e
c
y
c
l
e
[see
[
s
e
e
Clauses
C
l
a
u
s
e
s
9
9
(Software
(
S
o
f
t
w
a
r
e
unit
u
n
i
t
testing),
t
e
s
t
i
n
g
)
,
10
1
0
(Software
(
S
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
andtesting),
a
n
d
t
e
s
t
i
n
g
)
,
11
1
1
(Verification
(
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirements)
r
e
q
u
i
r
e
m
e
n
t
s
)
and
a
n
d
ISO
I
S
O
26262-4:2011,
2
6
2
6
2
-
4
:
2
0
1
1
,
Clause
C
l
a
u
s
e
8
8
(Item
(
I
t
e
m
integration
i
n
t
e
g
r
a
t
i
o
n
and
a
n
d
testing)].
t
e
s
t
i
n
g
)
]
.
C.4.3_
C
.
4
.
3
_
The
T
h
e
ASIL
A
S
I
L
of
o
f
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
equal
e
q
u
a
l
the
t
h
e
highest
h
i
g
h
e
s
t
ASIL
A
S
I
L
of
o
f
the
t
h
e
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
by
b
y
which
w
h
i
c
h
itis
i
t
i
s
used.
u
s
e
d
.
C.4.4
C
.
4
.
4
The
T
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
shall
s
h
a
l
l
be
b
e
planned,
p
l
a
n
n
e
d
,
specified
s
p
e
c
i
f
i
e
d
and
a
n
d
executed
e
x
e
c
u
t
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9.
9
.
Configurable
C
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
shall
s
h
a
l
l
be
b
e
verified
v
e
r
i
f
i
e
d
for
f
o
r
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
set
s
e
t
that
t
h
a
t
is
i
s
to
t
o
be
b
e
usedfor
u
s
e
d
f
o
r
the
t
h
e
item
i
t
e
m
development
d
e
v
e
l
o
p
m
e
n
t
under
u
n
d
e
r
consideration.
c
o
n
s
i
d
e
r
a
t
i
o
n
.
NOTE
N
O
T
E
Only
O
n
l
y
that
t
h
a
t
part
p
a
r
t
of
o
f
the
t
h
e
embedded
e
m
b
e
d
d
e
d
software
s
o
f
t
w
a
r
e
whose
w
h
o
s
e
behaviour
b
e
h
a
v
i
o
u
r
depends
d
e
p
e
n
d
s
on
o
n
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
is
i
s
verified
v
e
r
i
f
i
e
d
against
a
g
a
i
n
s
t
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
set.
s
e
t
.
C.4.5
C
.
4
.
5
For
F
o
r
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
a
a
simplified
s
i
m
p
l
i
f
i
e
d
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
lifecycle
l
i
f
e
c
y
c
l
e
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
Figures
F
i
g
u
r
e
s
C.2
C
.
2
or
o
r
C.3
C
.
3
may
m
a
y
be
b
e
applied.
a
p
p
l
i
e
d
.
NOTE
N
O
T
E
A
A
combination
c
o
m
b
i
n
a
t
i
o
n
of
o
f
the
t
h
e
followingverification
f
o
l
l
o
w
i
n
g
v
e
r
i
f
i
c
a
t
i
o
n
activities
a
c
t
i
v
i
t
i
e
s
can
c
a
n
achieve
a
c
h
i
e
v
e
the
t
h
e
completeverification
c
o
m
p
l
e
t
e
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
configured
c
o
n
f
i
g
u
r
e
d
software:
s
o
f
t
w
a
r
e
:
-
“verification
“
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software’,
s
o
f
t
w
a
r
e
’
,
-
“verification
“
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data”,
d
a
t
a
”
,
and
a
n
d
-
“verification
“
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
configured
c
o
n
f
i
g
u
r
e
d
software”.
s
o
f
t
w
a
r
e
”
.
This
T
h
i
s
is
i
s
achieved
a
c
h
i
e
v
e
d
by
b
y
either
e
i
t
h
e
r
—
—
verifying
v
e
r
i
f
y
i
n
g
a
a
range
r
a
n
g
e
of
o
f
admissible
a
d
m
i
s
s
i
b
l
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
in
i
n
a)
a
)
and
a
n
d
showing
s
h
o
w
i
n
g
complianceto
c
o
m
p
l
i
a
n
c
e
t
o
this
t
h
i
s
rangein
r
a
n
g
e
i
n
b),
b
)
,
or
o
r
—__
—
_
_
by
b
y
showing
s
h
o
w
i
n
g
complianceto
c
o
m
p
l
i
a
n
c
e
t
o
the
t
h
e
range
r
a
n
g
e
of
o
f
admissible
a
d
m
i
s
s
i
b
l
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
in
i
n
b)
b
)
and
a
n
d
performingc).
p
e
r
f
o
r
m
i
n
g
c
)
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
Figure
F
i
g
u
r
e
C.2
C
.
2
—
—
Variants
V
a
r
i
a
n
t
s
of
o
f
the
t
h
e
reference
r
e
f
e
r
e
n
c
e
phase
p
h
a
s
e
model
m
o
d
e
l
for
f
o
r
software
s
o
f
t
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
with
w
i
t
h
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
anddifferent
a
n
d
d
i
f
f
e
r
e
n
t
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
cata
c
a
t
a
Software
S
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
life
l
i
f
e
cycle
c
y
c
l
e
process
p
r
o
c
e
s
s
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
Calibration
C
a
l
i
b
r
a
t
i
o
n
Data
D
a
t
a
m
m
integrationof
i
n
t
e
g
r
a
t
i
o
n
o
f
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
configured
c
o
n
f
i
g
u
r
e
d
software
s
o
f
t
w
a
r
e
integration
i
n
t
e
g
r
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
Verification
V
e
r
i
f
i
c
a
t
i
o
n
and
a
n
d
validation
v
a
l
i
d
a
t
i
o
n
integration
i
n
t
e
g
r
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
Gata
G
a
t
a
Verification
V
e
r
i
f
i
c
a
t
i
o
n
and
a
n
d
validation
v
a
l
i
d
a
t
i
o
n
software
s
o
f
t
w
a
r
e
1
1
software
s
o
f
t
w
a
r
e
m
m
Figure
F
i
g
u
r
e
C.3
C
.
3
—
—
Variants
V
a
r
i
a
n
t
s
of
o
f
the
t
h
e
reference
r
e
f
e
r
e
n
c
e
phase
p
h
a
s
e
modelfor
m
o
d
e
l
f
o
r
software
s
o
f
t
w
a
r
e
development
d
e
v
e
l
o
p
m
e
n
t
with
w
i
t
h
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software
s
o
f
t
w
a
r
e
anddifferent
a
n
d
d
i
f
f
e
r
e
n
t
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
C.4.6
C
.
4
.
6
The
T
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
associated
a
s
s
o
c
i
a
t
e
d
with
w
i
t
h
software
s
o
f
t
w
a
r
e
components
c
o
m
p
o
n
e
n
t
s
shall
s
h
a
l
l
be
b
e
specified
s
p
e
c
i
f
i
e
d
to
t
o
ensure
e
n
s
u
r
e
the
t
h
e
correct
c
o
r
r
e
c
t
operation
o
p
e
r
a
t
i
o
n
and
a
n
d
expected
e
x
p
e
c
t
e
d
performanceof
p
e
r
f
o
r
m
a
n
c
e
o
f
the
t
h
e
configured
c
o
n
f
i
g
u
r
e
d
software.
s
o
f
t
w
a
r
e
.
This
T
h
i
s
shall
s
h
a
l
l
include:
i
n
c
l
u
d
e
:
-
the
t
h
e
valid
v
a
l
i
d
values
v
a
l
u
e
s
of
o
f
the
t
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data;
d
a
t
a
;
-
the
t
h
e
intent
i
n
t
e
n
t
and
a
n
d
usageofthe
u
s
a
g
e
o
f
t
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data:
d
a
t
a
:
the
t
h
e
range,
r
a
n
g
e
,
scaling
s
c
a
l
i
n
g
and
a
n
d
units,
u
n
i
t
s
,
if
i
f
applicable,
a
p
p
l
i
c
a
b
l
e
,
with
w
i
t
h
their
t
h
e
i
r
dependence
d
e
p
e
n
d
e
n
c
e
onthe
o
n
t
h
e
operating
o
p
e
r
a
t
i
n
g
state;
s
t
a
t
e
;
the
t
h
e
knowninterdependencies
k
n
o
w
n
i
n
t
e
r
d
e
p
e
n
d
e
n
c
i
e
s
betweendifferent
b
e
t
w
e
e
n
d
i
f
f
e
r
e
n
t
calibration
c
a
l
i
b
r
a
t
i
o
n
data:
d
a
t
a
:
and
a
n
d
NOTE
N
O
T
E
Interdependencies
I
n
t
e
r
d
e
p
e
n
d
e
n
c
i
e
s
can
c
a
n
exist
e
x
i
s
t
betweencalibration
b
e
t
w
e
e
n
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
within
w
i
t
h
i
n
one
o
n
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
set
s
e
t
or
o
r
between
b
e
t
w
e
e
n
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
in
i
n
different
d
i
f
f
e
r
e
n
t
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
sets
s
e
t
s
such
s
u
c
h
as
a
s
those
t
h
o
s
e
applied
a
p
p
l
i
e
d
to
t
o
related
r
e
l
a
t
e
d
functions
f
u
n
c
t
i
o
n
s
implemented
i
m
p
l
e
m
e
n
t
e
d
in
i
n
the
t
h
e
software
s
o
f
t
w
a
r
e
of
o
f
separate
s
e
p
a
r
a
t
e
ECUs.
E
C
U
s
.
the
t
h
e
knowninterdependencies
k
n
o
w
n
i
n
t
e
r
d
e
p
e
n
d
e
n
c
i
e
s
between
b
e
t
w
e
e
n
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
and
a
n
d
calibration
c
a
l
i
b
r
a
t
i
o
n
data.
d
a
t
a
.
NOTE
N
O
T
E
Configuration
C
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
can
c
a
n
have
h
a
v
e
an
a
n
impact
i
m
p
a
c
t
on
o
n
the
t
h
e
configured
c
o
n
f
i
g
u
r
e
d
software
s
o
f
t
w
a
r
e
that
t
h
a
t
uses
u
s
e
s
the
t
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data.
d
a
t
a
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
C.4.7_
C
.
4
.
7
_
The
T
h
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
the
t
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
be
b
e
planned,
p
l
a
n
n
e
d
,
specified
s
p
e
c
i
f
i
e
d
and
a
n
d
executed
e
x
e
c
u
t
e
d
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-8:2011,
2
6
2
6
2
-
8
:
2
0
1
1
,
Clause
C
l
a
u
s
e
9.
9
.
Theverification
T
h
e
v
e
r
i
f
i
c
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
examine
e
x
a
m
i
n
e
whetherthe
w
h
e
t
h
e
r
t
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
is
i
s
within
w
i
t
h
i
n
its
i
t
s
specified
s
p
e
c
i
f
i
e
d
boundaries.
b
o
u
n
d
a
r
i
e
s
.
NOTE
N
O
T
E
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
can
c
a
n
also
a
l
s
o
be
b
e
performed
p
e
r
f
o
r
m
e
d
within
w
i
t
h
i
n
application-specific
a
p
p
l
i
c
a
t
i
o
n
-
s
p
e
c
i
f
i
c
software
s
o
f
t
w
a
r
e
verification,
v
e
r
i
f
i
c
a
t
i
o
n
,
or
o
r
at
a
t
runtime
r
u
n
t
i
m
e
by
b
y
the
t
h
e
configurable
c
o
n
f
i
g
u
r
a
b
l
e
software.
s
o
f
t
w
a
r
e
.
C.4.8
C
.
4
.
8
The
T
h
e
ASIL
A
S
I
L
of
o
f
the
t
h
e
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
equal
e
q
u
a
l
the
t
h
e
highest
h
i
g
h
e
s
t
ASIL
A
S
I
L
of
o
f
the
t
h
e
software
s
o
f
t
w
a
r
e
safety
s
a
f
e
t
y
requirementsit
r
e
q
u
i
r
e
m
e
n
t
s
i
t
canviolate.
c
a
n
v
i
o
l
a
t
e
.
C.4.9
C
.
4
.
9
To
T
o
detect
d
e
t
e
c
t
unintended
u
n
i
n
t
e
n
d
e
d
changes
c
h
a
n
g
e
s
of
o
f
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
calibration
c
a
l
i
b
r
a
t
i
o
n
data,
d
a
t
a
,
mechanisms
m
e
c
h
a
n
i
s
m
s
for
f
o
r
the
t
h
e
detection
d
e
t
e
c
t
i
o
n
of
o
f
unintended
u
n
i
n
t
e
n
d
e
d
changesofdata
c
h
a
n
g
e
s
o
f
d
a
t
a
aslisted
a
s
l
i
s
t
e
d
in
i
n
Table
T
a
b
l
e
C.1
C
.
1
shall
s
h
a
l
l
be
b
e
applied.
a
p
p
l
i
e
d
.
Table
T
a
b
l
e
C.1
C
.
1
—
—
Mechanismsfor
M
e
c
h
a
n
i
s
m
s
f
o
r
the
t
h
e
detection
d
e
t
e
c
t
i
o
n
of
o
f
unintended
u
n
i
n
t
e
n
d
e
d
changesof
c
h
a
n
g
e
s
o
f
data
d
a
t
a
Methods
M
e
t
h
o
d
s
Plausibility
P
l
a
u
s
i
b
i
l
i
t
y
checks
c
h
e
c
k
s
on
o
n
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
Redundantstorageofcalibration
R
e
d
u
n
d
a
n
t
s
t
o
r
a
g
e
o
f
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
1c
1
c
Error
E
r
r
o
r
detecting
d
e
t
e
c
t
i
n
g
codes?
c
o
d
e
s
?
+
+
~
~
|
|
es
e
s
a
a
4
4
Error
E
r
r
o
r
detecting
d
e
t
e
c
t
i
n
g
codes
c
o
d
e
s
may
m
a
y
also
a
l
s
o
be
b
e
implementedin
i
m
p
l
e
m
e
n
t
e
d
i
n
the
t
h
e
hardware
h
a
r
d
w
a
r
e
in
i
n
accordance
a
c
c
o
r
d
a
n
c
e
with
w
i
t
h
ISO
I
S
O
26262-5.
2
6
2
6
2
-
5
.
C.4.10
C
.
4
.
1
0
The
T
h
e
planning
p
l
a
n
n
i
n
g
of
o
f
the
t
h
e
generation
g
e
n
e
r
a
t
i
o
n
and
a
n
d
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
shall
s
h
a
l
l
specify:
s
p
e
c
i
f
y
:
-
the
t
h
e
proceduresthat
p
r
o
c
e
d
u
r
e
s
t
h
a
t
shall
s
h
a
l
l
be
b
e
followed;
f
o
l
l
o
w
e
d
;
-
the
t
h
e
tools
t
o
o
l
s
for
f
o
r
generating
g
e
n
e
r
a
t
i
n
g
calibration
c
a
l
i
b
r
a
t
i
o
n
data;
d
a
t
a
;
and
a
n
d
-
the
t
h
e
proceduresfor
p
r
o
c
e
d
u
r
e
s
f
o
r
verifying
v
e
r
i
f
y
i
n
g
calibration
c
a
l
i
b
r
a
t
i
o
n
data.
d
a
t
a
.
NOTE
N
O
T
E
Verification
V
e
r
i
f
i
c
a
t
i
o
n
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
can
c
a
n
weauae
w
e
a
u
a
e
checking
c
h
e
c
k
i
n
g
the
t
h
e
value
v
a
l
u
e
ranges
r
a
n
g
e
s
of
o
f
calibration
c
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
or
o
r
the
t
h
e
interdependencies
i
n
t
e
r
d
e
p
e
n
d
e
n
c
i
e
s
betweendifferent
b
e
t
w
e
e
n
d
i
f
f
e
r
e
n
t
calibration
c
a
l
i
b
r
a
t
i
o
n
data.
d
a
t
a
.
C.5
C
.
5
Work
W
o
r
k
products
p
r
o
d
u
c
t
s
C.5.1
C
.
5
.
1
Configuration
C
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
C.4.1
C
.
4
.
1
and
a
n
d
C.4.3.
C
.
4
.
3
.
C.5.2
C
.
5
.
2
Calibration
C
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
C.4.6.
C
.
4
.
6
.
C.5.3
C
.
5
.
3
Safety
S
a
f
e
t
y
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
C.4.1,
C
.
4
.
1
,
C.4.4,
C
.
4
.
4
,
C.4.5,
C
.
4
.
5
,
C.4.9
C
.
4
.
9
and
a
n
d
C.4.10.
C
.
4
.
1
0
.
C.5.4
C
.
5
.
4
Configuration
C
o
n
f
i
g
u
r
a
t
i
o
n
data
d
a
t
a
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
C.4.3.
C
.
4
.
3
.
C.5.5
C
.
5
.
5
Calibration
C
a
l
i
b
r
a
t
i
o
n
data
d
a
t
a
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirement
r
e
q
u
i
r
e
m
e
n
t
C.4.8.
C
.
4
.
8
.
C.5.6
C
.
5
.
6
Software
S
o
f
t
w
a
r
e
verification
v
e
r
i
f
i
c
a
t
i
o
n
plan
p
l
a
n
(refined)
(
r
e
f
i
n
e
d
)
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
C.4.2,
C
.
4
.
2
,
C.4.4,
C
.
4
.
4
,
C.4.7
C
.
4
.
7
and
a
n
d
C.4.10.
C
.
4
.
1
0
.
C.5.7
C
.
5
.
7
Verification
V
e
r
i
f
i
c
a
t
i
o
n
specification
s
p
e
c
i
f
i
c
a
t
i
o
n
resulting
r
e
s
u
l
t
i
n
g
thai
t
h
a
i
requirements
r
e
q
u
i
r
e
m
e
n
t
s
C.4.4
C
.
4
.
4
and
a
n
d
C.4.7.
C
.
4
.
7
.
C.5.8
C
.
5
.
8
Verification
V
e
r
i
f
i
c
a
t
i
o
n
report
r
e
p
o
r
t
resulting
r
e
s
u
l
t
i
n
g
from
f
r
o
m
requirements
r
e
q
u
i
r
e
m
e
n
t
s
C.4.1,
C
.
4
.
1
,
C.4.4,
C
.
4
.
4
,
C.4.7
C
.
4
.
7
and
a
n
d
C.4.8.
C
.
4
.
8
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Annex
A
n
n
e
x
D
D
(informative)
(
i
n
f
o
r
m
a
t
i
v
e
)
Freedom
F
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
D.1
D
.
1
Objectives
O
b
j
e
c
t
i
v
e
s
The
T
h
e
objective
o
b
j
e
c
t
i
v
e
is
i
s
to
t
o
provide
p
r
o
v
i
d
e
examples
e
x
a
m
p
l
e
s
of
o
f
faults
f
a
u
l
t
s
that
t
h
a
t
can
c
a
n
cause
c
a
u
s
e
interference
i
n
t
e
r
f
e
r
e
n
c
e
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
(e.g.
(
e
.
g
.
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
of
o
f
different
d
i
f
f
e
r
e
n
t
software
s
o
f
t
w
a
r
e
partitions).
p
a
r
t
i
t
i
o
n
s
)
.
Additionally,
A
d
d
i
t
i
o
n
a
l
l
y
,
this
t
h
i
s
Annex
A
n
n
e
x
provides
p
r
o
v
i
d
e
s
examples
e
x
a
m
p
l
e
s
of
o
f
possible
p
o
s
s
i
b
l
e
mechanismsthat
m
e
c
h
a
n
i
s
m
s
t
h
a
t
can
c
a
n
be
b
e
considered
c
o
n
s
i
d
e
r
e
d
for
f
o
r
the
t
h
e
prevention,
p
r
e
v
e
n
t
i
o
n
,
or
o
r
detection
d
e
t
e
c
t
i
o
n
and
a
n
d
mitigation
m
i
t
i
g
a
t
i
o
n
ofthe
o
f
t
h
e
listed
l
i
s
t
e
d
faults.
f
a
u
l
t
s
.
NOTE
N
O
T
E
The
T
h
e
capability
c
a
p
a
b
i
l
i
t
y
and
a
n
d
effectiveness
e
f
f
e
c
t
i
v
e
n
e
s
s
of
o
f
the
t
h
e
mechanisms
m
e
c
h
a
n
i
s
m
s
usedto
u
s
e
d
t
o
prevent,
p
r
e
v
e
n
t
,
or
o
r
to
t
o
detect
d
e
t
e
c
t
and
a
n
d
mitigate
m
i
t
i
g
a
t
e
relevant
r
e
l
e
v
a
n
t
faults
f
a
u
l
t
s
is
i
s
assessed
a
s
s
e
s
s
e
d
during
d
u
r
i
n
g
development.
d
e
v
e
l
o
p
m
e
n
t
.
D.2
D
.
2
General
G
e
n
e
r
a
l
D.2.1
D
.
2
.
1
Achievementof
A
c
h
i
e
v
e
m
e
n
t
o
f
freedom
f
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
To
T
o
develop
d
e
v
e
l
o
p
or
o
r
evaluate
e
v
a
l
u
a
t
e
the
t
h
e
achievementof
a
c
h
i
e
v
e
m
e
n
t
o
f
freedom
f
r
e
e
d
o
m
from
f
r
o
m
interference
i
n
t
e
r
f
e
r
e
n
c
e
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
elements,
e
l
e
m
e
n
t
s
,
the
t
h
e
effects
e
f
f
e
c
t
s
of
o
f
the
t
h
e
exemplary
e
x
e
m
p
l
a
r
y
faults,
f
a
u
l
t
s
,
and
a
n
d
the
t
h
e
propagation
p
r
o
p
a
g
a
t
i
o
n
of
o
f
the
t
h
e
possible
p
o
s
s
i
b
l
e
resulting
r
e
s
u
l
t
i
n
g
failures
f
a
i
l
u
r
e
s
can
c
a
n
be
b
e
considered.
c
o
n
s
i
d
e
r
e
d
.
D.2.2
D
.
2
.
2
Timing
T
i
m
i
n
g
and
a
n
d
execution
e
x
e
c
u
t
i
o
n
With
W
i
t
h
respect
r
e
s
p
e
c
t
to
t
o
timing
t
i
m
i
n
g
constraints,
c
o
n
s
t
r
a
i
n
t
s
,
the
t
h
e
effects
e
f
f
e
c
t
s
of
o
f
faults
f
a
u
l
t
s
such
s
u
c
h
as
a
s
those
t
h
o
s
e
listed
l
i
s
t
e
d
below
b
e
l
o
w
can
c
a
n
be
b
e
considered
c
o
n
s
i
d
e
r
e
d
for
f
o
r
the
t
h
e
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
executed
e
x
e
c
u
t
e
d
in
i
n
each
e
a
c
h
software
s
o
f
t
w
a
r
e
partition:
p
a
r
t
i
t
i
o
n
:
—
—
blocking
b
l
o
c
k
i
n
g
of
o
f
execution;
e
x
e
c
u
t
i
o
n
;
—
—
deadlocks;
d
e
a
d
l
o
c
k
s
;
—
—
livelocks;
l
i
v
e
l
o
c
k
s
;
—
—
incorrect
i
n
c
o
r
r
e
c
t
allocation
a
l
l
o
c
a
t
i
o
n
of
o
f
execution
e
x
e
c
u
t
i
o
n
time;
t
i
m
e
;
—
—
incorrect
i
n
c
o
r
r
e
c
t
synchronization
s
y
n
c
h
r
o
n
i
z
a
t
i
o
n
between
b
e
t
w
e
e
n
software
s
o
f
t
w
a
r
e
elements.
e
l
e
m
e
n
t
s
.
EXAMPLE
E
X
A
M
P
L
E
Mechanisms
M
e
c
h
a
n
i
s
m
s
such
s
u
c
h
as
a
s
cyclic
c
y
c
l
i
c
execution
e
x
e
c
u
t
i
o
n
scheduling,
s
c
h
e
d
u
l
i
n
g
,
fixed
f
i
x
e
d
priority
p
r
i
o
r
i
t
y
based
b
a
s
e
d
scheduling,
s
c
h
e
d
u
l
i
n
g
,
time
t
i
m
e
triggered
t
r
i
g
g
e
r
e
d
scheduling,
s
c
h
e
d
u
l
i
n
g
,
monitoring
m
o
n
i
t
o
r
i
n
g
of
o
f
processor
p
r
o
c
e
s
s
o
r
execution
e
x
e
c
u
t
i
o
n
time,
t
i
m
e
,
program
p
r
o
g
r
a
m
sequence
s
e
q
u
e
n
c
e
monitoring
m
o
n
i
t
o
r
i
n
g
and
a
n
d
arrival
a
r
r
i
v
a
l
rate
r
a
t
e
monitoring
m
o
n
i
t
o
r
i
n
g
can
c
a
n
be
b
e
considered.
c
o
n
s
i
d
e
r
e
d
.
D.2.3
D
.
2
.
3
Memory
M
e
m
o
r
y
With
W
i
t
h
respect
r
e
s
p
e
c
t
to
t
o
memory,
m
e
m
o
r
y
,
the
t
h
e
effects
e
f
f
e
c
t
s
of
o
f
faults
f
a
u
l
t
s
such
s
u
c
h
as
a
s
those
t
h
o
s
e
listed
l
i
s
t
e
d
below
b
e
l
o
w
can
c
a
n
be
b
e
considered
c
o
n
s
i
d
e
r
e
d
for
f
o
r
software
s
o
f
t
w
a
r
e
elements
e
l
e
m
e
n
t
s
executed
e
x
e
c
u
t
e
d
in
i
n
each
e
a
c
h
software
s
o
f
t
w
a
r
e
partition:
p
a
r
t
i
t
i
o
n
:
—
—
corruption
c
o
r
r
u
p
t
i
o
n
of
o
f
content;
c
o
n
t
e
n
t
;
—
—
read
r
e
a
d
or
o
r
write
w
r
i
t
e
access
a
c
c
e
s
s
to
t
o
memory
m
e
m
o
r
y
allocated
a
l
l
o
c
a
t
e
d
to
t
o
another
a
n
o
t
h
e
r
software
s
o
f
t
w
a
r
e
element.
e
l
e
m
e
n
t
.
EXAMPLE
E
X
A
M
P
L
E
Mechanisms
M
e
c
h
a
n
i
s
m
s
such
s
u
c
h
as
a
s
memory
m
e
m
o
r
y
protection,
p
r
o
t
e
c
t
i
o
n
,
parity
p
a
r
i
t
y
bits,
b
i
t
s
,
error-correcting
e
r
r
o
r
-
c
o
r
r
e
c
t
i
n
g
code
c
o
d
e
(ECC),
(
E
C
C
)
,
cyclic
c
y
c
l
i
c
redundancy
r
e
d
u
n
d
a
n
c
y
check
c
h
e
c
k
(CRC),
(
C
R
C
)
,
redundantstorage,
r
e
d
u
n
d
a
n
t
s
t
o
r
a
g
e
,
restricted
r
e
s
t
r
i
c
t
e
d
access
a
c
c
e
s
s
to
t
o
memory,
m
e
m
o
r
y
,
static
s
t
a
t
i
c
analysis
a
n
a
l
y
s
i
s
of
o
f
memory
m
e
m
o
r
y
accessing
a
c
c
e
s
s
i
n
g
software
s
o
f
t
w
a
r
e
andstatic
a
n
d
s
t
a
t
i
c
allocation
a
l
l
o
c
a
t
i
o
n
can
c
a
n
be
b
e
used.
u
s
e
d
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
D.2.4
D
.
2
.
4
Exchangeofinformation
E
x
c
h
a
n
g
e
o
f
i
n
f
o
r
m
a
t
i
o
n
With
W
i
t
h
respect
r
e
s
p
e
c
t
to
t
o
the
t
h
e
exchange
e
x
c
h
a
n
g
e
of
o
f
information,
i
n
f
o
r
m
a
t
i
o
n
,
the
t
h
e
causes
c
a
u
s
e
s
for
f
o
r
faults
f
a
u
l
t
s
or
o
r
effects
e
f
f
e
c
t
s
of
o
f
faults
f
a
u
l
t
s
such
s
u
c
h
as
a
s
thoselisted
t
h
o
s
e
l
i
s
t
e
d
below
b
e
l
o
w
can
c
a
n
be
b
e
considered
c
o
n
s
i
d
e
r
e
d
for
f
o
r
each
e
a
c
h
senderor
s
e
n
d
e
r
o
r
each
e
a
c
h
receiver:
r
e
c
e
i
v
e
r
:
—
—
repetition
r
e
p
e
t
i
t
i
o
n
of
o
f
information;
i
n
f
o
r
m
a
t
i
o
n
;
—
—
loss
l
o
s
s
of
o
f
information;
i
n
f
o
r
m
a
t
i
o
n
;
—
—
delay
d
e
l
a
y
of
o
f
information;
i
n
f
o
r
m
a
t
i
o
n
;
—
—
insertion
i
n
s
e
r
t
i
o
n
of
o
f
information;
i
n
f
o
r
m
a
t
i
o
n
;
—
—
masqueradeorincorrect
m
a
s
q
u
e
r
a
d
e
o
r
i
n
c
o
r
r
e
c
t
addressing
a
d
d
r
e
s
s
i
n
g
of
o
f
information;
i
n
f
o
r
m
a
t
i
o
n
;
—
—
incorrect
i
n
c
o
r
r
e
c
t
sequence
s
e
q
u
e
n
c
e
ofinformation;
o
f
i
n
f
o
r
m
a
t
i
o
n
;
—
—
corruption
c
o
r
r
u
p
t
i
o
n
of
o
f
information;
i
n
f
o
r
m
a
t
i
o
n
;
—
—
asymmetric
a
s
y
m
m
e
t
r
i
c
information
i
n
f
o
r
m
a
t
i
o
n
sent
s
e
n
t
from
f
r
o
m
a
a
senderto
s
e
n
d
e
r
t
o
multiple
m
u
l
t
i
p
l
e
receivers;
r
e
c
e
i
v
e
r
s
;
—
—
information
i
n
f
o
r
m
a
t
i
o
n
from
f
r
o
m
a
a
sender
s
e
n
d
e
r
received
r
e
c
e
i
v
e
d
by
b
y
only
o
n
l
y
a’
a
’
subsetof
s
u
b
s
e
t
o
f
the
t
h
e
receivers;
r
e
c
e
i
v
e
r
s
;
—
—
blocking
b
l
o
c
k
i
n
g
access
a
c
c
e
s
s
to
t
o
a
a
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
channel.
c
h
a
n
n
e
l
.
NOTE
N
O
T
E
The
T
h
e
exchange
e
x
c
h
a
n
g
e
of
o
f
information
i
n
f
o
r
m
a
t
i
o
n
between
b
e
t
w
e
e
n
elements
e
l
e
m
e
n
t
s
executed
e
x
e
c
u
t
e
d
in
i
n
different
d
i
f
f
e
r
e
n
t
software
s
o
f
t
w
a
r
e
partitions
p
a
r
t
i
t
i
o
n
s
or
o
r
different
d
i
f
f
e
r
e
n
t
ECUs
E
C
U
s
includes
i
n
c
l
u
d
e
s
signals,
s
i
g
n
a
l
s
,
data,
d
a
t
a
,
messages,etc.
m
e
s
s
a
g
e
s
,
e
t
c
.
EXAMPLE1
E
X
A
M
P
L
E
1
Information
I
n
f
o
r
m
a
t
i
o
n
can
c
a
n
be
b
e
exchangedusing
e
x
c
h
a
n
g
e
d
u
s
i
n
g
|/O-devices,
|
/
O
-
d
e
v
i
c
e
s
,
data
d
a
t
a
busses,etc.
b
u
s
s
e
s
,
e
t
c
.
EXAMPLE2
E
X
A
M
P
L
E
2
Mechanisms
M
e
c
h
a
n
i
s
m
s
such
s
u
c
h
as
a
s
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
protocols,
p
r
o
t
o
c
o
l
s
,
information
i
n
f
o
r
m
a
t
i
o
n
repetition,
r
e
p
e
t
i
t
i
o
n
,
loop
l
o
o
p
back
b
a
c
k
of
o
f
information,
i
n
f
o
r
m
a
t
i
o
n
,
acknowledgement
a
c
k
n
o
w
l
e
d
g
e
m
e
n
t
of
o
f
information,
i
n
f
o
r
m
a
t
i
o
n
,
appropriate
a
p
p
r
o
p
r
i
a
t
e
configuration
c
o
n
f
i
g
u
r
a
t
i
o
n
of
o
f
I/O
I
/
O
pins,
p
i
n
s
,
separated
s
e
p
a
r
a
t
e
d
point-to-point
p
o
i
n
t
-
t
o
-
p
o
i
n
t
unidirectional
u
n
i
d
i
r
e
c
t
i
o
n
a
l
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
objects,
o
b
j
e
c
t
s
,
unambiguous
u
n
a
m
b
i
g
u
o
u
s
bidirectional
b
i
d
i
r
e
c
t
i
o
n
a
l
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
objects,
o
b
j
e
c
t
s
,
asynchronous
a
s
y
n
c
h
r
o
n
o
u
s
data
d
a
t
a
communication,
c
o
m
m
u
n
i
c
a
t
i
o
n
,
synchronous
s
y
n
c
h
r
o
n
o
u
s
data
d
a
t
a
communication,
c
o
m
m
u
n
i
c
a
t
i
o
n
,
event-triggered
e
v
e
n
t
-
t
r
i
g
g
e
r
e
d
data
d
a
t
a
buses,
b
u
s
e
s
,
event-triggered
e
v
e
n
t
-
t
r
i
g
g
e
r
e
d
data
d
a
t
a
buses
b
u
s
e
s
with
w
i
t
h
time-triggered
t
i
m
e
-
t
r
i
g
g
e
r
e
d
access,
a
c
c
e
s
s
,
time-triggered
t
i
m
e
-
t
r
i
g
g
e
r
e
d
data
d
a
t
a
busses,
b
u
s
s
e
s
,
mini-slotting,
m
i
n
i
-
s
l
o
t
t
i
n
g
,
bus
b
u
s
arbitration
a
r
b
i
t
r
a
t
i
o
n
by
b
y
priority
p
r
i
o
r
i
t
y
and
a
n
d
bus
b
u
s
arbitration
a
r
b
i
t
r
a
t
i
o
n
bypriority
b
y
p
r
i
o
r
i
t
y
can
c
a
n
be
b
e
used.
u
s
e
d
.
EXAMPLE3
E
X
A
M
P
L
E
3
Communication
C
o
m
m
u
n
i
c
a
t
i
o
n
protocols
p
r
o
t
o
c
o
l
s
can
c
a
n
contain
c
o
n
t
a
i
n
information
i
n
f
o
r
m
a
t
i
o
n
such
s
u
c
h
asidentifiers
a
s
i
d
e
n
t
i
f
i
e
r
s
for
f
o
r
communication
c
o
m
m
u
n
i
c
a
t
i
o
n
objects,
o
b
j
e
c
t
s
,
keep
k
e
e
p
alive
a
l
i
v
e
messages,alive
m
e
s
s
a
g
e
s
,
a
l
i
v
e
counters,
c
o
u
n
t
e
r
s
,
sequence
s
e
q
u
e
n
c
e
numbers,
n
u
m
b
e
r
s
,
error
e
r
r
o
r
detection
d
e
t
e
c
t
i
o
n
codes
c
o
d
e
s
and
a
n
d
error-correcting
e
r
r
o
r
-
c
o
r
r
e
c
t
i
n
g
codes.
c
o
d
e
s
.
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
Bibliography
B
i
b
l
i
o
g
r
a
p
h
y
[1]
[
1
]
[2]
[
2
]
ISO/IEC
I
S
O
/
I
E
C
12207,
1
2
2
0
7
,
Systems
S
y
s
t
e
m
s
and
a
n
d
software
s
o
f
t
w
a
r
e
engineering
e
n
g
i
n
e
e
r
i
n
g
—
—
Softwarelife
S
o
f
t
w
a
r
e
l
i
f
e
cycle
c
y
c
l
e
processes
p
r
o
c
e
s
s
e
s
IEC
I
E
C
61508
6
1
5
0
8
(all
(
a
l
l
parts),
p
a
r
t
s
)
,
Functional
F
u
n
c
t
i
o
n
a
l
safety
s
a
f
e
t
y
of
o
f
electrical/electronic/programmable
e
l
e
c
t
r
i
c
a
l
/
e
l
e
c
t
r
o
n
i
c
/
p
r
o
g
r
a
m
m
a
b
l
e
electronic
e
l
e
c
t
r
o
n
i
c
safety-related
s
a
f
e
t
y
-
r
e
l
a
t
e
d
systems
s
y
s
t
e
m
s
[3]
[
3
]
MISRA-C:2004,
M
I
S
R
A
-
C
:
2
0
0
4
,
Guidelines
G
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
use
u
s
e
of
o
f
the
t
h
e
C
C
languagein
l
a
n
g
u
a
g
e
i
n
critical
c
r
i
t
i
c
a
l
systems,
s
y
s
t
e
m
s
,
ISBN
I
S
B
N
978-0-9524156-2-6,
9
7
8
-
0
-
9
5
2
4
1
5
6
-
2
-
6
,
MIRA,
M
I
R
A
,
October
O
c
t
o
b
e
r
2004
2
0
0
4
[4]
[
4
]
MISRA
M
I
S
R
A
AC
A
C
AGC,
A
G
C
,
Guidelines
G
u
i
d
e
l
i
n
e
s
for
f
o
r
the
t
h
e
application
a
p
p
l
i
c
a
t
i
o
n
of
o
f
MISRA-C:2004
M
I
S
R
A
-
C
:
2
0
0
4
in
i
n
the
t
h
e
context
c
o
n
t
e
x
t
of
o
f
automatic
a
u
t
o
m
a
t
i
c
code
c
o
d
e
generation,
g
e
n
e
r
a
t
i
o
n
,
ISBN
I
S
B
N
978-1-906400-02-6,
9
7
8
-
1
-
9
0
6
4
0
0
-
0
2
-
6
,
MIRA,
M
I
R
A
,
November
N
o
v
e
m
b
e
r
2007
2
0
0
7
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true}
ISO
I
S
O
26262-6:2011(E)
2
6
2
6
2
-
6
:
2
0
1
1
(
E
)
ee...
e
e
.
.
.
ICS
I
C
S
43.040.10
4
3
.
0
4
0
.
1
0
Price
P
r
i
c
e
based
b
a
s
e
d
on
o
n
40
4
0
pages
p
a
g
e
s