When an automated driving system (SAE level >= 3) takes over the dynamic driving task from the driver, the E/E system must not only be correct but also highly available. System correctness can be achieved by introducing monitoring functions in redundant channels. Introducing redundancy by adding a second channel should also allow the system to continue the dynamic driving task if the first channel fails.

Additionally, the target values for PMHF can realistically only be achieved by introducing redundancies. However, while redundant channels are a straightforward solution, channels are only “truly redundant” if they are sufficiently independent of each other.

To be able to keep development complexities, costs, and time as low as possible, there is a strong push for homogeneous redundancy in the automotive industry. While the advantages of homogeneous redundancy are obvious, it raises the questions of whether and how sufficient independence can still be achieved, especially if the redundant elements have (partially) not been developed according to the highest ASIL.

The presentation provides answers to the crucial question “How independent is independent enough?” by analyzing the ISO 26262 approach with respect to the sufficient independence objective and its weaknesses. Additionally, methodologies for resolving coupling factors and for judging the sufficiency of the achieved technical independence are proposed to provide the foundation for building a solid and safe AD system. Find out how to:

• Solve the availability challenge of automated driving
• Leverage redundant channels
• Address the weaknesses of the ISO 26262 and discover some practical applications