Safety Plan 写作工程化深度 — 10 章模板 + Milestone + RACI + Confirmation Strategy

按 Tier-1 中型主驱项目 4-8 周分段:

• ① Item Definition(1-2 周)— 锁 item scope + assumed SG;早于 HARA(HARA 是后续 milestone 输出,Safety Plan 必先把 item boundary 定)。粗稿允许 "preliminary SG list"
• ② Lifecycle Tailoring(1 周)— 按 ISO 26262-2 §6.4.5 "tailor" V-cycle 阶段,标哪些 work product 是 in-scope / 哪些 cut(理由必 justify)。reuse SEooC = 大幅 cut;新设计 = 全部 in
• ③ Milestone + Confirmation Strategy(1-2 周)— 列 M0-M4 5 个 milestone + 每个的 confirmation measure + reviewer 独立性(per ASIL)。ASIL D 必有 3 个 confirmation review(Safety Plan / Safety Case / FSAR)
• ④ Resource + RACI(1 周)— 写 §6 RACI matrix 5 角色 × 10 阶段;写 §7 Tool Qualification list(每 tool 的 TCL 等级 + qualification 路径)
• ⑤ v1.0 Lock(1 周)— OEM + Tier-1 SafetyMgr + I3 三方签字;Polarion / DOORS lock。lock 后任何改动必走 ECN + 重 review

写作总工时 ~2-3 FTE × 月。最大风险在 ① Item Definition — 写不准(scope 太宽 / 太窄)整套 HARA / FSC / TSC 都会跟着错,项目末期发现要返工 ≥ 3 月。

ISO 26262-2 Annex A 给的 Safety Plan 模板偏抽象。下表是工程实际写法(每章带 "写什么 / 长度 / 谁审"),三大重点章(★)在 §2-§5 详细展开:

典型 Safety Plan 20-40 页。比 Safety Manual 写作(40-80)和 HSI 写作(40-80)短,因为 Safety Plan 是项目元数据 + 角色 + 里程碑(不是工程内容)。

下表把每段 + 为何不可省 一次列清:

下面把 6 段在主驱 800V SiC inverter 上跑完整一遍:

§3 Item Definition (Project EV-MainInv-2026-A)

  a. System Boundary
    INCLUDED:
      - 800V SiC traction inverter (3-phase H-bridge)
      - Inverter MCU (AURIX TC397) + supporting SBC (NXP FS65)
      - 6× Driver IC (TI ISO5852S)
      - Position sensor (Resolver + R/D converter)
      - Current sensing (3-phase shunt + isolated amp)
      - DC link capacitor + active discharge circuit
    EXCLUDED:
      - PMSM motor (separate item, ITEM-MOT-2026-B)
      - 12V LV system (separate item, ITEM-LV-2026-C)
      - OBC / DC-DC charger (out of scope; ITEM-OBC-2026-D)

  b. Interface Specification
    - OEM CAN-FD bus: torque request + status (ID 0x18FF50E0-0x18FF50EF)
    - HV bus to battery: 800V nominal, 400-950V range
    - 12V supply from OEM low-voltage net
    - Resolver from motor side (Sin/Cos 2-channel differential)
    - HVIL interlock loop (per ECE R100)

  c. Assumed Operating Environment
    - Ambient temperature: −40°C to +85°C
    - Junction temperature: up to +175°C (SiC die)
    - Vibration: ISO 16750-3 Test V (sine + random, 24 g RMS)
    - 12V supply: 6-16V (cold crank + load dump)
    - EMC: CISPR 25 Class 5 (radiated + conducted)
    - Lifetime: 15 years / 300,000 km

  d. Preliminary Safety Goal List
    - SG-1: Unintended torque event < 200 ms (ASIL D)
    - SG-2: Reverse torque (rollback) < 100 ms (ASIL D)
    - SG-3: HV bus discharge < 5 s after key-off (ASIL C per ECE R100)
    - SG-4: HV insulation R_iso > 100 Ω/V (ASIL B per ECE R100)
    - SG-5: Wheel lockup prevention at all speeds (ASIL D)
    (NOTE: subject to refinement by HARA in M1 milestone)

  e. Reuse Assumptions (SEooC)
    - Driver IC ISO5852S: ASIL D SEooC per TI Safety Manual rev 2.0
      (AoU compliance verified by Tier-1 HSI §3)
    - MCU AURIX TC397: ASIL D SEooC per Infineon Safety Manual
      (lockstep + flash ECC inherited)
    - SBC FS65: ASIL D SEooC per NXP Safety Manual
      (WDG + voltage monitor inherited)

  f. Out-of-Scope (explicit)
    - Motor design + bench test (separate Tier-1)
    - 12V auxiliary BMS (separate ITEM)
    - Charger / OBC (separate ITEM)
    - Functional non-safety features (audio / climate)

写法 tips:

• 显式 INCLUDED + EXCLUDED 双列(only INCLUDED 是反模式)
• Preliminary SG 必标 "subject to refinement by HARA M1"(防 SG list 被当 final)
• Reuse Assumptions 显式 vendor + Safety Manual rev + Tier-1 verification 责任
• Out-of-Scope 必有,防项目末期"为什么没考虑 OBC"扯皮

5 个标准 milestone(参 Confirmation Measures 深度)。每个 milestone 必有 confirmation review,review 类型按 ASIL 等级。下表把 milestone × confirmation × reviewer 独立性一次列清:

ASIL 严格度差(ISO 26262-2 Table 1,独立性等级 I1/I2/I3,I3=independent department 为最高级,同公司可):

• ASIL A / B:confirmation review 多为 I1(independent from the person responsible)
• ASIL C:confirmation review I2(independent from the team)→ assessment/audit 升 I3
• ASIL D:全部升 I3 = independent department(资源/管理/release authority 独立于责任部门;同公司即可,ISO 不强制 TÜV 外审——外部第三方是 OEM/市场惯例)(参 ISO 26262-2 Table 1)

§5 漏掉的根因都是"milestone 无 confirmation + reviewer 独立性不达"。下表把 5 类典型反模式列清,review 时按此查:

主驱 ASIL D 项目典型 5 角色,每个角色的核心职责 + 与其他角色的独立性约束:

RACI 4 字母对应 4 种参与度,每条记录 1 个 cell:

• R (Responsible):执行人;干活的
• A (Accountable):最终拍板;1 人 / 阶段,不可多
• C (Consulted):被咨询;双向沟通
• I (Informed):被通知;单向告知

ASIL D 项目典型规则:A 不能与 R 同人 + R 不能与 Reviewer 同人(独立性硬约束)。

ISO 26262-8 §11.4.5 把 tool 按"对 work product 影响"分 3 级:

• TCL 1:tool 错不影响 safety(e.g., text editor, version control)— 无需 qualification
• TCL 2:tool 错可能影响 safety,但有 secondary check(e.g., Polarion + manual review)— 需要 use-case validation
• TCL 3:tool 错直接传到 safety work product,无 secondary check(e.g., MATLAB Simulink code gen, compiler)— 需要 full qualification

下面是主驱 ASIL D 项目典型 8 个 SW tool 的 TCL 评级 + qualification 路径示例。每个 tool 必引 cert ID / validation report ID:

Tool list 写错的根因都是"列不全 + TCL 评级图省事"。下表把 3 类典型反模式列清: