Acronym · Safety & Security
HARA (Hazard Analysis and Risk Assessment)
The vehicle-level activity that identifies hazardous events caused by item malfunctions, rates each by severity, exposure and controllability, assigns an ASIL, and derives the safety goals that the rest of the safety lifecycle must satisfy.
- Also known as
- Hazard and risk analysis
- Type
- Acronym
- Domain
- Safety & Security, Safety lifecycle
Notes
Performed by the vehicle or system integrator; a chip supplier working as an SEooC must assume a HARA outcome instead.
Overview
HARA, short for hazard analysis and risk assessment, is the ISO 26262 activity that identifies how malfunctions of a vehicle function could lead to harm, rates each hazardous event for severity, exposure and controllability, and from those ratings assigns an ASIL and a safety goal. It is carried out at vehicle level, on the item being developed, before any hardware or software design exists. Every safety requirement that later reaches a chip can be traced back to a safety goal produced by a HARA.
How it works
The team starts from the item definition, for example an electric power steering system, and lists its functions. For each function it asks how it could malfunction, such as unintended steering torque or loss of assistance, and combines those malfunctions with operational situations, such as motorway driving or parking, to form hazardous events. Methods such as HAZOP guidewords or systems theoretic process analysis are often used to make the list systematic.
Each hazardous event is then rated on three scales defined in ISO 26262: severity of the possible injuries (S0 to S3), exposure, meaning how often the vehicle is in that situation (E0 to E4), and controllability, meaning how likely a typical driver is to avoid the harm (C0 to C3). A table in the standard combines the three ratings into ASIL A to D or QM, where QM means ordinary quality management is enough. If any rating is at its lowest level, no ASIL is assigned.
The output is a set of safety goals, each a top-level requirement such as avoiding unintended steering above a given level, carrying the highest ASIL of the hazardous events it covers and often a safe state and fault tolerant time. Severity can draw on crash statistics, but exposure and controllability rely more on engineering judgement, so the reasoning must be recorded and reviewed.
Examples
- An NHTSA study of a generic electric power steering system that used HAZOP, functional FMEA and STPA alongside ISO 26262 and identified four vehicle-level safety goals.
- A hazardous event of unintended full braking at motorway speed being rated for severity, exposure and controllability and assigned a high ASIL.
- A radar SoC supplier writing assumed safety goals and ASILs for its part, developed out of context, for customers to confirm against their own HARA.
Why it matters
Vehicle makers and system suppliers perform the HARA, but its results flow down to semiconductor suppliers as the ASIL and safety requirements that a chip must meet. Functional safety managers and architects at chip companies need to understand it to interpret customer requirements, and to state sensible assumptions when developing a part as a safety element out of context, before any specific vehicle is known.
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 7 pages of the Hub. In each group, the pages that mention it most come first.
Lifecycle stages and gates
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary