ISO 26262 HARA — by configuration alone
A hazard analysis and risk assessment is the point where a functional safety programme either becomes rigorous or becomes a spreadsheet. Severity, exposure and controllability go in; an ASIL comes out; safety goals follow from it. Get the determination wrong and everything downstream inherits the error.
The question here was narrow and falsifiable: can KF host a real HARA without code changes, and does it get the ASIL right?
What was built
An electric power steering system, analysed properly:
- The item definition and its functions.
- A library of malfunctioning behaviours — assist in the wrong direction, assist when none was requested, loss of assist, excessive assist.
- A library of operational situations — highway at speed on a straight, highway on a curve, urban at low speed in dense traffic, a parking manoeuvre, rural road on a wet surface.
- Hazardous events at the intersections that matter, each classified S/E/C.
- Safety goals derived from them, each carrying its ASIL, safe state and FTTI.
None of that needed a new node type or a new item class. Four existing types, the tag
vocabulary, and the ⊃ type edge carried the entire analysis.
The arithmetic was checked, not assumed
Ten reference vectors were written down before the configuration was built, covering the ordinary determinations and the overrides that catch people out — the S0, E0 and C0 cases where the table stops applying.
All ten reproduced. By configuration alone.
That matters because a risk matrix is easy to get subtly wrong, and a subtly wrong one is worse than an obviously broken one. So KF shows its working: every item's risk model page names the matrix that scored it, the scales it was read on, and the rules in the order they were applied.
Two standards, one database
A vehicle programme does not only do HARA. There is a conventional component FMEA running alongside it, on a completely different scale — RPN or Action Priority, not ASIL.
Those used to be mutually exclusive, because the risk model was global to the database. It no longer is. A steering pump scored on a conventional FMEA scale sits in the same database as the hazardous events scored on ISO 26262, each routed to its own matrix, each showing which ruler measured it.
Inheritance, at programme scale
A second programme was created as an instance of the first. It inherited the functions, the hazardous events, their safety goals and the whole operational-situation catalogue — without anyone re-entering them.
That is the same mechanism as the CAPA case, applied to a reference HARA rather than a machining operation. A platform's hazard knowledge becomes the starting point for every vehicle built on it.
What it did not do
Six defects had to be fixed before the run completed, and a further four corrections were applied the following day. Running the exercise is what surfaced them.
The limit worth stating plainly, because anyone doing this at scale will hit it:
Generating the hazardous events is manual. A HARA is a cross-product — every malfunction against every operational situation — and KF does not yet generate that grid for you. The libraries are reusable and the classification is fast, but somebody creates the intersections. For a full vehicle programme that is real work, and it is the single largest gap in the model today.