Deriving a representative variant for the functional safety development according to ISO 26262
Felix S. Schranner Alireza Abassi Misheni Jork Warnecke
eess.SY cs.SY eess.SP



 



The emerging mass individualization <cit.> in series produced road vehicles, superseding mass customization, entails an increase in variants. The question “How may the functional safety development effort, corresponding to the variant numbers, be tackled while complying to the standard ISO 26262:2018? <cit.>” motives this work.

The lever on containing the effort is most effective when applied in the development life-cycle as early as possible. The initiating functional safety artifact is the item definition. Strategic clustering of variants into a few or even a single item-definition(s) is feasible by exploiting platform development. Yet, the functional safety development effort for each defined item may only be limited when basing all subsequent phases on one single representative variant. 
In this work we particularly elaborate on answering the question “Under what conditions can a representative variant be defined?”, accompanied by the notion of “How is it defined?”. Therefore, we assess the ISO 26262:2018 <cit.> for deriving prerequisites on a representative variant. Furthermore, we propose a structured and efficient method to determine representative variants given vehicle parameters and a framing context. The method is exemplified for two easily comprehensible use-case situations in drivetrain development. The characteristic equations may be used for future drivetrain functional safety development.
 




   functional safety ISO 26262 drivetrain representative variantworst-case hazard analysis and risk assessment










§ INTRODUCTION




As stated in the introduction of ISO 26262:2018 <cit.>, the increasing technological complexity, software content and mechatronics implementation in road vehicles entails an increase in risks due to systematic and random hardware failures. Yet, safety, described as the absence of unreasonable risks, has become one of the key factors for a consumer purchase decision <cit.>. Thus, the automotive industry is urged to ensure safety. The ISO 26262:2018 <cit.> gives guidance for establishing functional safety in road vehicles. Therefore, it assumes a V-model <cit.> development process and standardizes thereupon the safety lifecycle process of automotive manufacturers <cit.>. 
The second edition of the ISO 26262, <cit.> generalizes the management and engineering activities, principles and techniques for passenger vehicles formulated in ISO 26262 first edition <cit.> to road vehicles with a maximum gross weight of 3500 kg. See <cit.> for an overview of major changes between ISO 26262:2011, i.e. first edition, <cit.> and ISO 26262:2018, i.e. second edition, <cit.>, or e.g. <cit.> for a review of ISO 26262:2011 <cit.>.
 

Let alone the increasing complexity of software-intensive safety-critical embedded systems <cit.>, the increase in complexity attributes significantly to the growth of variants of vehicle derivates <cit.>.
In modular development of series produced road vehicles multiple variants derive from the same platforms to fulfill specific customer needs. For a review of product design paradigm refer to <cit.>. Mass customization in series produced vehicles considers variable hardware, e.g. lights, drivetrain components, the wheelbase, the ground clearance, behavior, e.g. parameterisations or different operational modes, or even entire functions. 

Assuring safety, i.e. compliance to <cit.>, for road vehicles with nowadays large variance and complex embedded systems is costly and time-consuming <cit.>. The business  and program management, however, are interested in achieving a high compliance coverage while keeping costs low <cit.>.
Multiple variants may be clustered in a single item definition on the basis of common requirements, see <cit.> Part 3 Section 5.

To limit development effort, the subsequent phases of functional safety development according to ISO 26262:2018 <cit.> have to be pursued with only a few representative variants of the cluster. Yet, how and on what basis is a representative variant defined?


Yoe <cit.>, for example, discusses representative scenarios commonly employed in risk analysis. Among the failure-scenarios are the best-case, most likely and worst-case scenario. Thereby, the worst-case scenario is the one best-known <cit.>.

Design of experiment (DoE) targets towards minimizing the number of test candidates while concurrently acquiring most information by appropriately combining input factors <cit.>. In the context of validation testing, a worst-case parameter combination permits to draw the conclusion if or if not a device is usable, see e.g. IEC 62366:2007 <cit.> Annex D or <cit.>, a process at the limit of acceptable operating conditions yields a product as specified, see e.g. <cit.>, or a system performs within the specified bounds, see <cit.>. 


This publication elaborates in the first part on the considerations to be made to determine a representative variant that is in accordance to <cit.>, see Section <ref>. Based thereupon, an efficient method is formulated that agrees with <cit.> in Section <ref>. In the second part of this work, basic models for selecting the representative variant for functional safety development for the drivetrain are derived, see Section <ref>.
For an application example, a set of variants are clustered as one item. Their use-case dependent representative variants are determined in Section <ref>. Concluding remarks are stated in Section <ref>.





§ A REPRESENTATIVE VARIANT ACCORDING TO ISO 26262





 §.§ Basic considerations to derive a representative variant



According to hazard theory, see e.g. <cit.>, a hazardous event consists of the three necessary elements: a hazard source, an (initiating) mechanism and a target. In the context of <cit.>, the hazard source is the item described in the item definition at vehicle level according to ISO 26262:2018 <cit.>-3 Sec. 5. The initiating mechanism is the malfunction of the item in the context of a certain operational mode or situation, stating a use-case. The target is the potentially harmed human(s).


To define a hazardous event, the item without internal safety mechanisms is evaluated with the hazard analysis and risk assessment (HARA), described in ISO 26262:2018 <cit.> Part 3 Sec. 6.
According to <cit.> Part 3 Sec. 6.4.3, hazards are classified conservatively with respect to severity (S), probability of exposure (E) and controllability (C), “i.e. whenever there is a reasonable doubt, a higher S, E or C classification is to be chosen.” <cit.>. Thereby, <cit.> circumvents the shortfall of not providing a truly objective rating methodology, yet, instead leaving the ASIL classification to the skills and the mental model of domain technical experts <cit.>. 
Moreover, the“ level of rigor required for higher ASIL values is considerably high as compared to a lower ASIL value. Therefore, the automotive industry is always driven towards lower
ASIL values in order to keep their development costs down. This inherent bias can also sometimes lead to an inconsistency in the ASIL ratings.”<cit.>.

Nevertheless, to determine S, the potential harm caused to each person at risk is evaluated, see <cit.> Part 3 Sec. 6.4.3.2. If applicable, the potential injuries shall be clustered to derive the highest S-classification. A structured aid to determine S is the Abbreviated Injury Scale (AIS) <cit.> provided e.g. in Appendix B of <cit.> Part 3. Alternative ratings may be found e.g. in <cit.> Table E.1. Also, to classify S <cit.> tabulates data of vehicle velocities and collision types to severity. Yet, the parameters are not sufficiently exhaustive <cit.> to objectively determine S. 
According to <cit.> Part 3 Sec 6.4.2.1 “The operational situations and operating modes in which an item's malfunctioning behavior will result in a hazardous event shall be described; ...”.

Determining E thus requires analysis of e.g. driving scenarios and conditions. The German Verband Der Automobilindustrie e.V. (VDA) has gathered statistical data and derived the Situationskatalog E-Parameter nach ISO 26262-3 <cit.> for representative use-case scenarios in conjunction with E-classifications.

The controllability (C) is classified based on the probability that a representative driver is able to retain or regain control of the vehicle if a hazardous event occurs, or other road users in the vicinity are able to influence the situation such to avoid the mishap, see <cit.> Part 3 Sec 6.4.3.8 and Annex B.4. The road user or driver ability to act is the key determining factor, i.e. human factors given technical means, see e.g. <cit.>. In practice the controllability may be evaluated by expert judgment of well-experienced testers accompanied with statistical data.
However, even on basis of well-tabulated data, classification is prone to inter-rateability and intra-rateability variations <cit.>, see <cit.>, further justifying a pessimistic classification.


The situations and modes are identical for the unity of the variants of one item given the same requirements. Thus, E is independent from technical realizations. Yet, the severity S and the controllability C both depend on the technical realization of the item, see e.g. <cit.>. I.e. the hazardous situation needs to be classified for the ASIL with each of the variants of the item definition.

However, <cit.> Part 3 Sec. 6.4.4.1 states that “A safety goal shall be determined for each hazardous event with an ASIL evaluated in the hazard analysis and risk assessment. If similar safety goals are determined, these may be combined into one safety goal.” The amendment “The ASIL determined for the hazardous event shall be assigned to the corresponding safety goal. If similar safety goals are combined into a single one, in accordance with 6.4.4.1, the highest ASIL shall be assigned to the combined safety goal.”, <cit.> Part 3 Sec. 6.4.4.2,  explicitly encourages clustering. Consequently, the clustering of similar hazardous events is compliant to <cit.>. 
Thereby, the worst-case hazardous event, i.e. the one with the highest ASIL-classification, is representative for the cluster.

Again, two of the three hazard elements (hazard source, initiating mechanism, and target) are vehicle-independent: the use-case and target. 
Given these two hazard elements, the variant with the biggest hazardous potential completes the worst-case event. 
On basis of these three elements, a representative ASIL-classification is assessed. 




 §.§ Efficiently constructing a representative variant


How can the worst-case variant be determined efficiently? This implies that performing a HARA for each variant needs to be unnecessary; instead, one HARA on basis of the worst-case variant shall suffice.

Constructing a worst-case scenario relies on conservatism to credit for uncertainty in input parameters and the analyst’s judgment to choose that set of input values that yields the worst possible outcome from a model, see <cit.>. According to Gardner et al. <cit.> “The worst-case approach [...] allows examination of all of the critical [...] variables together, thus ensuring that additive effects and interactions are tested for.”
Loring <cit.> analyzes the definitions of worst-case scenario in the context of usability testing for medical devices based on IEC 62366:2007 <cit.> Annex D and the Guidance Document Applying Human Factors and Usability Engineering to Medical Devices <cit.>. She summarizes that for both, risk assessment and validation, parameters with the highest potential for harm, in this work's context highest ASIL, and those of actual use ought to be simulated or chosen.  

Actual use-case situations are described in the agreed-upon situation catalogue Situationskatalog E-Parameter nach ISO 26262-3<cit.>. Applying <cit.> leads to worst-case environmental parameters. 
According to ISO 26262:2018 <cit.> Part 3 Sec. 6.4.3.8 NOTE 3 cases of reasonably foreseeable misuse are also to be considered. Thereby, cases of reasonably foreseeable misuse need to be derived from actual use-case situations such that the parameters result from a boundary value analysis. The example of “not keeping the required distance to the vehicle in front as a common behavior” is provided in <cit.> Part 3 Sec. 6.4.3.8 NOTE 3. It derives from the actual use-case of two vehicles following another. Moreover, this case is an observed common behavior.
Note that these parameters are variant-independent, yet, important for constructing the worst-case scenarios.




Figure <ref> depicts the steps for determining the representative variant. 
As a first step, the framing use-case is defined, i.e. the operational mode, driving scenario and conditions in which a fault occurs. 
Next, the characteristic that determines the biggest hazardous potential in a given use-case is formulated. 
Based on the analyst’s judgment <cit.>, a physical model is constituted. Therefore, contextual assumptions are drawn to filter key influential parameters.
Next, the to be assessed characteristic is modeled mathematically. 

Assume the general case that multiple vehicle-parameters characterize the variants. Moreover, each parameter is independent and has a certain range of validity.
Even with simplifying assumptions, the parameters may define a high-dimensional, nonlinear mathematical model. 
For efficient approaches to determine the global worst-case parameter combination refer to <cit.>.
With the worst-case parameter combination the worst-case representative variant is stated.

Alternatively, the item definition may detail the parametric realization of specific variants. Consequently, the mathematical model can be evaluated directly for each variant.
A direct comparison of the characteristic value for the variants leads to the one with the biggest hazardous potential.




 §.§ Consequence for subsequent phases


With the worst-case representative variant at hand, the hazardous situations are evaluated, their ASIL derived and the safety goals formulated, see <cit.>, Part 3, Sec. 6. According to <cit.>, Part 3, Sec. 7.2 the safety measures developed within the scope of the functional safety concept need to comply with the safety goals. Hence, the safety measures are developed according to the representative variant. Thereby, these are stated comprehensively. In accordance with the functional safety concept, the product development at system level is pursued on basis of the worst-case representative variant. The safety analysis as part of phase <cit.> Part 3 Sec. 6.4 may be used to detail variant-specifics. 

The integration and testing phase, see <cit.> Part 4 Sec. 7 is variant-independent. A worst-case approach does not guarantee completeness of verification.
 
The safety validation is the final development phase at system level. It provides the evidence that the safety goals are achieved at the vehicle level by means of the integrated safety measures.  Validation of safety goals is applied to the item integrated at the vehicle level and the validation plan includes test procedures for each safety goal with a pass/fail criterion. Thereby, the evidence of appropriateness of the functional safety concept is provided. 
<cit.> Part 4 Sec. 8 stresses that the representative context and representative variant suffice for validation, see particularly <cit.> Part 4 Sec. 8.4.1 and 8.4.2.





§ REPRESENTATIVE VARIANT FOR FUNCTIONAL SAFETY DRIVETRAIN DEVELOPMENT



Within the following, models characterizing a vehicle's hazardous potential in the domain of drivetrain development are derived. We specifically study the use-cases “drivetrain fault entailing an unintended acceleration with, without loss of traction”, respectively. 
In conjunction with vehicle parameters these use-cases state sufficiently complex scenarios. On the basis of well-established assumptions, the characteristics are formulated with key vehicle parameters. These are in agreement with the findings of <cit.>.

Note that the process for use-case situation assessment of a fault unintentionally decelerating a road vehicle is as described within the following. One merely needs to replace the accelerating with the decelerating torque and the applicable transmission ratios.




 §.§ Use-Case “Drivetrain fault entailing an unintended acceleration with loss of traction”




  §.§.§ The framing use-case scenario assumptions


The scenario of driving a 90^∘-turn on an inner city road with low friction constitutes the underlying worst-case driving situation. The latter condition is listed as FS020 Driving on road with low friction. Loss of traction is facilitated due to a friction coefficient of μ < 0.5 +/- 0.1. The situation is evaluated as E3, see <cit.>. For this analysis, a friction coefficient of μ = 0.4 is assumed. 
A 90^∘-turn minimizes the curve radius to approximately R = 4 m. The road bank angle is negligible for the considered inner-city road. 
In <cit.>, Chapter 8.5.2 the minimum curve radius is correlated to the driving velocity. One finds that a velocity of approximately V = 12.12 kph correlates to a curve with a radius of R = 4 m. 
The drivetrain faults to allow the maximum engine torque. The acceleration is large enough to overcome traction. Moreover, the mass of the variant is the curb weight.





  §.§.§ Characteristic of hazardous potential

According to friction circle theory, see e.g. <cit.>, the exchangeable forces between a tire and the road in the contact patch are bound by the friction force F_μ:  

    F_⊥^2+F_∥^2≤ F_μ^2.

F_∥ and F_⊥ are the accelerating (longitudinal) forces and the cornering (transversal) forces, respectively.

Traction is overcome if F_⊥^2+F_∥^2/F_μ^2 > 1. 
When at least one wheel pair of a vehicle loses traction, i.e. the front or rear wheels, it diverges from its original driving path. Consequently it releases its hazardous potential to road users. 
We propose 

    P_μ=F_⊥^2+F_∥^2/F_μ^2,

to characterize the hazardous potential of each variant. 

Note, the vehicle parameters that best describe the hazardous potential of a vehicle are the kinetic energy, the maximum acceleration and the friction, see <cit.>. The kinetic energy of the vehicle-system consists of the kinetic energy of the drivetrain and the vehicle in motion. 
Only due to the tire forces, the vehicle can translate the drivetrain energy, i.e. acceleration, into controllable kinetic energy of the vehicle in motion. Also, the kinetic energy of the vehicle in motion can only be controlled by means of the tires. Hence, the controllability depends on the ability to exchange forces between the road and the vehicle to maintain an intended driving path. If the left-hand side of Eq. <ref> exceeds its right-hand side, excess hazardous kinetic energy is in the system, which is, moreover, uncontrollable.   
Thus, a high value of P_μ correlates to a big hazardous potential and a higher classification of S and C.



  §.§.§ Physical Model








[9]l5cm
5cm
  
  
  
	
  (1,1.04177542)
    
    (0,0)
    < g r a p h i c s >

    (0.44936395,0.9877547)(0,0)[lt]β
    (0.72439347,0.33201421)(0,0)[lt]α̇
    (0.62419784,0.58782099)(0,0)[lt]R
    (0.53607751,1.02319949)(0,0)[lt]CG
    (0.19779418,1.03299061)(0,0)[lt]FA
    (0.81730034,1.03494886)(0,0)[lt]RA
    (0.42565551,0.85218122)(0,0)[lt]V
    (0.03052931,0.89069311)(0,0)[lt]δ
  
Kinematic single track model


The vehicle is modeled physically with the nonlinear kinematic single track model <cit.>. See e.g. <cit.> for further discussions of the model. Stationary steering is assumed. 
Key assumptions for this work are that the front and rear wheel pairs are modeled as a single wheel at each axle, see figure <ref>. The mass of the vehicle m_veh is concentrated at the center of gravity (CG). Moreover, roll dynamics and pitching are neglected. Aerodynamic forces are neither considered. While accelerating in a curve, the curve radius R, the steering angle δ and the side slip angle β are time-invariant. This implies that the yaw rate α̇ varies. 





  §.§.§ Mathematical Model

Based on the single track model, the equations of motion are constituted in <ref>. From these, i.e. Eqs. (<ref>) and (<ref>), expressions for F_∥, F_⊥ and F_μ are derived for the front and the rear axle, indicated with the subscripts FA and RA, respectively. With Eq. (<ref>) the hazardous potential is stated for the front and the rear axle:


    P_μ,FA= F_⊥, FA^2+F_∥, FA^2/F_μ, FA^2,


    P_μ,RA= F_⊥, RA^2+F_∥, RA^2/F_μ, RA^2,


Expression for F_∥, F_⊥ and F_μ may be found in <ref>.

Note that if a vehicle is a front-wheel drive or rear-wheel drive, F_∥, RA = 0, or  F_∥, FA = 0, respectively.





  §.§.§ Selecting the worst-case variant

Given (<ref>), (<ref>) a worst-case analysis of the vehicle parameters is performed.
Thereby, in case of undetermined variants, a worst-case parameter set is determined from which a worst case variant is constructed. 
Alternatively, given a set of variants with fixed parameters, the worst-case variant is selected. 
The worst-case parameter configuration or variant is the one for which  P_μ,FA or P_μ,RA is biggest. 
Note that a separate worst-case analysis is conducted for both cases: loss of traction of the front and rear axle, respectively.





 §.§ Use-Case “Drivetrain fault entailing an unintended acceleration without loss of traction”




  §.§.§ Use-case scenario assumptions


Maintaining traction implies that P_μ,FA< 1 and P_μ,RA<1, compare (<ref>), (<ref>), respectively.
The worst-case driving scenario is driving straight ahead on a road with a normal friction coefficient, i.e. μ = 1. According to <cit.> this situation evaluates as E4. 
A drivetrain faults to allow the maximum engine torque. This fault entails an unintended acceleration. 
Note that, the mass of the vehicle is the curb weight.



  §.§.§ Characteristic of hazardous potential

Given the scenario assumptions and description, the normalized accelerating potential of a vehicle 

    P_acc=P_acc, FA+P_acc, RA

characterizes the hazardous potential of a variant. 

Similar to Section <ref>, P_acc directly correlates to the the acceleration, and the friction; it indirectly correlates to the kinetic energy: The bigger P_acc, the more kinetic energy is built up in a short period of time.
A vehicle with a higher acceleration overcomes distances to targets more swiftly. The time that remains for a driver, passenger or other road users to control the situation is shorter for a vehicle with a higher P_acc. Moreover, the kinetic energy in the moment of a mishap is generally bigger for bigger P_acc. 
Thus, P_acc suits for characterizing the effects of the key vehicle parameters identified in e.g. <cit.> to determine the hazardous potential, and correlating to the classification of S and C. 



  §.§.§ Physical Model

We employ the physical model described in Section <ref>.
The steering angle δ, the yaw rate α̇ and the side slip angle β diminish.



  §.§.§ Mathematical Model


The normalized accelerating potential of the front, and rear axle are 


    P_acc, FA=F_∥, FA/F_μ, FA = T_FA l/r_dyn μ g m_veh l_RA,


    P_acc, RA=F_∥, RA/F_μ, RA = T_RA l/r_dyn μ g m_veh l_FA,


respectively. F_∥ and F_μ are derived for the front and the rear axle in <ref>.
Hence, the accelerating potential of a variant with dedicated engines for each axle is 

    P_acc=l/r_dyn μ g m_vehT_mot, FA i_FA l_FA + T_mot, RA i_RA l_RA/( l_FA  l_RA) .

In case a single engine is employed, the accelerating potential is 

    P_acc=l   T_mot/r_dyn μ g m_vehi_tot,FA l_FA + i_tot,RA l_RA/( l_FA  l_RA).




  §.§.§ Selecting the worst-case variant

In case that variants are undetermined, the vehicle parameters are chosen to obtain the biggest P_acc. Thereby, the conditions P_μ,FA< 1 and P_μ,RA<1 need to be fulfilled. Note that F_⊥ = 0.
From these parameters the worst-case variant is constructed.

In case the variants have been predetermined, for each variant the vehicle-parameters are set to maximize P_μ,FA and P_μ,RA. Yet, the conditions P_μ,FA< 1 and P_μ,RA<1 need to be fulfilled. Note that F_⊥ = 0. 
Proceeding, P_acc,FA, P_acc,RA are evaluated according to Eqs. (<ref>) and (<ref>), respectively, for each variant.
The worst-case variant is the one for which P_acc is biggest.





 §.§ Application example




  
1|c|Variants:    
  1cc]@c@B-Class 
 Sportcar 2017  
 RWD    
  1cc]@c@D-Class 
 SUV v9 2017 
 AWD    
  1cc]@c@F-Class 
 Sedan 
 AWD    
  1cc]@c@A-Class
 Hatchback 2017
 FWD    
	  1cc]@c@Large   
European Van 
 RWD    
  1cc]@c@B-Class 
 Hatchback  2017
 FWD    
  1cc]@c@European
 Van 
 FWD    
  1c|c]@c@E-Class
 Sedan 2017 
 AWD
 T_mot [Nm]       258        310       619       155       900       258       155       514    

r_dyn [m]        0.308      0.3575     0.3635     0.2915     0.4015     0.3105     0.3105     0.3815  

i_1st            3.358      3.358     4.596     3.78      3.1       3.358     3.78      4.38   

i_2nd            2.06       2.06      2.724     2.12      1.81      2.06      2.12      2.86   

i_3rd            1.404      1.404     1.864     1.36      1.41      1.404     1.36      1.92   

i_4th            1          1         1.464     1.03      1         1         1.03      1.37   

i_5th            0.713      0.713     1.231     0.84      0.71      0.713     0.84      1      

i_6th            0.582      0.582     1         0         0.61      0.528     0         0.82   

i_7th            0          0         0.824     0         0         0         0         0.7   

i_Diff,FA        0          1.64       1.06      4.1       0         4.1       4.1       1.06   

i_Diff,RA        4.1        2.46       1.59      0         4.1       0         0         1.59   

l_FA [m]         1.186      1.05      1.265     1.1       1.35      1.04      1.35      1.4    

l_RA [m]         1.144      1.61      1.895     1.25      1.75      1.56      1.23      1.65   

m_veh [kg]       1140       1610      2220      833       2400      1230      1300      1830   


  Example variants, adopted from <cit.>
  



  
1|c|Variants:    
   1cc]@c@E-Class
 SUV 2017      
 AWD    
  1cc]@c@C-Class
 Hatchback 2017
 FWD    
  1cc]@c@D-Class
 Sedan 2017    
 FWD    
  1cc]@c@D-Class
 Minivan 2017  
 FWD    
  1c|c]@c@SUV
 full size 
 AWD 
	
 T_mot [Nm]      413        258       310       310       514   

r_dyn [m]        0.402     0.334     0.334     0.3685     0.407 

i_1st            3.358     3.358     3.358     3.358     4.38  

i_2nd            2.06      2.06      2.06      2.06      2.86  

i_3rd            1.404     1.404     1.404     1.404     1.92  

i_4th            1         1         1         1         1.37  

i_5th            0.713     0.713     0.713     0.713     1     

i_6th            0.582     0.582     0.582     0.582     0.82  

i_7th            0         0         0         0         0.7   

i_Diff,FA        1.64       4.1       4.1       4.1       1.06  

i_Diff,RA        2.46       0         0         0         1.59  

l_FA [m]         1.18      1.015     1.11      1.35      1.33  

l_RA [m]         1.77      1.895     1.67      1.65      1.81  

m_veh [kg]       1860      1412      1530      2000      2532  


  Example variants, adopted from <cit.>, continued
  


As an application example, the variants listed in tables <ref> and <ref> are studied for their potential to constitute representative variants for use-cases of a
drivetrain fault entailing an unintended acceleration with loss of traction at front, rear axle, respectively, and drivetrain fault entailing an unintended acceleration with loss of traction at rear axle. Note that for the AWD variants, the torque distribution to the front and rear axle are fixed and at a ratio of 3 to 2, resulting in i_Diff,FA, i_Diff,RA. 




  §.§.§ Use-Case “Drivetrain fault entailing an unintended acceleration with loss of traction at front axle”





  
Given the set of variants and their parameters, and the use-case scenario as detailed in Section <ref>, Eq. (<ref>) is evaluated for each variant. The procedure described in Section <ref> holds. The results are tabulated in Table <ref>.
Thereby, for all variants, the first gear is selected to maximize i_tot. 

One finds that the vehicle A-Class Hatchback 2017, FWD, see table <ref> represents the worst-case variant for the case of a drivetrain fault entailing an unintended acceleration with loss of traction of the front axle.




  §.§.§ Use-Case “Drivetrain fault entailing an unintended acceleration with loss of traction at rear axle”




Given the set of variants and their parameters, and the use-case scenario as detailed in Section <ref>, Eq. (<ref>) is evaluated for each variant. The procedure described in Section <ref> holds. The results are listed in Table <ref>.
Thereby, for all variants, the first gear is selected to maximize i_tot.

One finds that the vehicle Large European Van, RWD, see table <ref>, represents the worst-case variant for the case of a drivetrain fault entailing an unintended acceleration with loss of traction of the rear axle.




  §.§.§ Use-Case “Drivetrain fault entailing an unintended acceleration without loss of traction”





  
Given the set of variants and their parameters, and the use-case scenario as detailed in Section <ref>, the worst-case P_acc, see Eq. (<ref>), is evaluated for each variant. Thereby, the procedure of Section <ref> holds. 
The results are listed in Tables <ref>. Also, the gear, the corresponding total gear ratios for the front and rear axle, i_tot,FA and i_tot,RA, P_μ,FA and P_μ,RA, P_acc,FA, P_acc,RA are listed. 

One finds that the vehicle SUV full size, AWD, see table <ref>, represents the variant for the case of a drivetrain fault entailing an unintended acceleration without loss of traction.





§ CONCLUSION


In this work we have found that a well-defined item definition is the key to limit the effort for functional safety development. We have pointed out that in platform development common requirements allow clustering variants into a single item definition. 
A method to define cluster-representative variants for functional safety development according to <cit.> has been developed. As a prerequisite the variants listed in the item definition are to be put in a context, i.e. a use-case situation. To comply with ISO 26262:2018 <cit.> both, a representative variant, defined by its configuration parameters, and the scenario conditions need to adhere to the worst-case assumption. 
A key step in efficiently deriving a use-case specific representative worst-case variant is to state a characteristic that relates parameters of the item to the hazard-source potential of the item. 
Assuming the use-case scenario, a physical model shall be stated such to focus the item parameters to the most relevant ones. Subsequent mathematical modeling specifies the characteristic in terms of item parameters. An extreme value analysis leads to the sought worst-case, representative variant. It is to be used for all the subsequent steps of functional safety development.

The method has been applied to assess two use-case situations in drivetrain functional safety development: “Drivetrain fault entailing an unintended acceleration with loss of traction” and “Drivetrain fault entailing an unintended acceleration without loss of traction”. For the two use-case situations characteristics have been proposed that may be used for functional safety development.  




§ ACKNOWLEDGMENTS


The authors acknowledge their colleagues of techcos and the Technische University of Munich for invigorating discussions. Elisa Schranner is acknowledged for constructive criticism of the manuscript. The Dean of Mechanical Engineering at the Technische University of Munich, Nikolaus Adams, is acknowledged for supporting the first author to pursue this work.  






§ DERIVATION OF MATHEMATICAL MODEL FOR CONSIDERED DRIVETRAIN USE-CASES




 §.§ Configuration

An accelerating vehicle, modeled with the nonlinear kinematic single track model <cit.>, driving a curve of radius R at a momentary velocity V, see Section <ref>, is considered.












The vehicle is depicted in the x-y-plane and x-z-plane in Fig. <ref> and Fig. <ref>, respectively. The forces acting on the wheels/axle are shown. 
F_∥ and F_⊥ are the longitudinal (accelerating) and transversal forces acting on the wheels. T_FA, T_RA denote the front- and rear-wheel/axle torque, r_dyn is the dynamic wheel radius, which, due to assuming stationarity and neglecting pitching, is identical for the front and rear wheels and time invariant. F_N, F_N, FA and F_N, RA are the normal forces. The normal force F_N= m_veh g, with g=9,81 m/s^2, m_veh denoting the gravitational constant and the vehicle mass. Also, l = l_FA+l_RA is the wheel base.
The Ackermann turning angle and side slip angle are approximated as

    tan δ = l/R' = l/√(R^2 - l_RA^2) ,


    tan β = l_RA/R' = l_RA/√(R^2 - l_RA^2)










The inertial (I), vehicle-body (B) and front axle (FA) coordinate systems are depicted in Fig. <ref>. R(Ṙ,R̈) and β(β̇,β̈), are the curve radius and angular rotation of the vehicle body coordinate system with respect to the inertial system, respectively, see Fig. <ref>. The FA-system is rotated about the B-system by δ, see Fig. <ref>.



 §.§ Transformation of coordinate systems

Following rotational coordinate transformations are relevant:

2

r_FA=A_F,Br_B =
( [  cos δ  sin δ      0; -sin δ  cos δ      0;      0      0      1;        ]) r_B
 
r_B=A_B,Ir_I   =
( [  cos β -sin β      0;  sin β  cos β      0;      0      0      1;        ]) r_I

 r_I: position vector in I-System

r_B: position vector in B-System

r_FA: position vector in FA-System





 §.§ Forces acting on the wheels / axles

Position vector CG (center of gravity), FA, RA in I-, B-System

The coordinate vectors for the CG, the front- and rear-axle are, see Fig. <ref>: 

    x_I,0CG =
    ( [ 0; R; 0;   ])
       x_I,0FA =
    ( [ -l_FA cos β;  l_FA sin β;           0;             ]) 
       x_I,0RA =
    ( [   l_RA cos β; - l_RA sin β;            0;              ])


    x_B,0CG =
    ( [ -R sin β;  R cos β;        0;          ])
       x_B,0FA =
    ( [ -l_FA;     0;     0;       ]) 
       x_B,0RA =
    ( [ l_RA;    0;    0;      ])


Velocity & acceleration of CG

For the absolute velocity and acceleration of the CG one finds

    ẋ_I,0CG = 
    d ẋ_I,0CG/dt+(α̇ + β̇) ×x_B,0CG= ( [ -R   (α̇ + β̇);              Ṙ;              0;                ])


    ẋ_B,0CG = A_B,I ẋ_I,0CG  =( [ -R  (α̇ + β̇) cos β - Ṙ  sin β;  Ṙ cos β - R  (α̇ + β̇)  sin β;                              0;                                ])



    ẍ_I,0CG =d ẋ_I,0CG/dt+(α̇ + β̇) ×ẋ_I,0CG=
    ( [ - 2  Ṙ(α̇ + β̇) - R (α̈ + β̈);            R̈ - R (α̇ + β̇)^2;                             0;                               ])



    ẍ_B,0CG = A_B,I ẍ_I,0CG=
    ( [  - cos β[2  Ṙ(α̇ + β̇) + R (α̈ + β̈)] - sin β[ R̈ - R (α̇ + β̇)^2]; - sin β[2  Ṙ(α̇ + β̇) + R (α̈ + β̈)]  + cos β[ R̈ - R (α̇ + β̇)^2];                                                                  0;                                                                    ])

As stated in Section <ref>, the accelerating vehicle follows a curve of constant R with velocity V(t); thus, α̈≠ 0. Moreover, stationary steering is assumed, i.e. β̇=0. Thus 

    R = V/β̇ + α̇ = V/α̇

Hence, Eq. (<ref>) to (<ref>) become




    ẋ_I,0CG =  ( [ -R   α̇;       0;       0;         ])
     = ( [ -V;  0;  0;    ])


    ẋ_B,0CG =( [    -R α̇  cos β; - R   α̇  sin β;               0;                 ])=( [   -V  cos β; - V   sin β;           0;             ])



    ẍ_I,0CG =
      ( [   - R α̈; - R α̇^2;        0;          ])



    ẍ_B,0CG =
      ( [  - cos β[ R α̈] + sin β[  R α̇^2]; - sin β[ R α̈]  - cos β[  R α̇^2];                                 0;                                   ])

Conservation of momentum in body coordinate system in CG

For this system the equations for conservation of momentum and angular momentum about the center of gravity are:



    m_vehẍ_B,0CG =∑_i^ F_i,B



    m_veh( [  - cos β[ R α̈] + sin β[  R α̇^2]; - sin β[ R α̈]  - cos β[  R α̇^2];                                 0;                                   ])    =
       ( [    0;    0; -F_N;      ]) +( [ -F_∥, RA;  F_⊥, RA;   F_N,RA;          ]) +
    ( [   cos δ - sin δ       0;   sin δ   cos δ       0;       0       0       1;         ])
    ( [ -F_∥, FA;  F_⊥, FA;   F_N,FA;          ])=
       =( [  -F_∥, RA-F_∥, FA cos δ - F_⊥, FA sin δ; F_⊥, RA - F_∥, FA sin δ + F_⊥, FA cos δ;                      -F_N+F_N,RA+F_N,FA ])




    d L_CG, B/dt =  l_FA, B×F_FA, B+F_RA, B×l_RA, B =
    ( [  -F_∥, FA cos δ - F_⊥, FA sin δ; - F_∥, FA sin δ + F_⊥, FA cos δ;                          F_N,FA;                                 ]) ×( [ -l_FA;     0;     0;       ])+				
    				( [ - F_∥, RA;   F_⊥, RA;    F_N,RA;           ]) ×( [ l_RA;    0;    0;      ])
             =
    (0;   F_N,RAl_RA-F_N,FAl_FA; -F_⊥, RA l_RA + (-F_∥, FA sin δ + F_⊥, FA cos δ)l_FA)^T

With 

    d L_CG/dt=(0; 0;α̈ m_veh 0)^T = 0

From Eqs. (<ref>), (<ref>) one finds that

    F_⊥, FA=F_∥, FA R (l_FA sin δ cos β - l_RA sin (β - δ)) - F_∥, RA R l_RA sin β - V^2 l_RA m_veh/R ( l_FA cos β cos δ + l_RA cos(β - δ)),
 

    F_⊥, RA=- l_FA( F_∥, FA R sin β + F_∥, RA R sin β cos δ + V^2 m_veh cos δ)/R ( l_FA cos β cos δ + l_RA cos(β - δ)) .

The second entry of Eq. (<ref>) and the third entry of Eq. (<ref>) yield that
 

    F_N,FA= l_RA/lF_N,


    F_N,RA= l_FA/lF_N.




The friction force correlates to the normal force according to F_μ= μ  F_N. μ=μ(μ^⋆,w_T,h_T) 
is the friction coefficient that depends on the road-tire friction coefficient μ^⋆, the tire width w_T and the height of the tire wall h_T. Within the scope of this work, we assume μ = μ^⋆ and neglect the influence of w_T and h_T.
For each axle, T_X=F_∥, X  r_dyn with X ∈{FA; RA} holds. If a vehicle has a single engine and a differential gear to distribute the torque T_mot to the front and rear axle,  the total transmission ratios for the front and rear axle are:


    i_tot, FA= i_gear i_Diff, FA=n_mot/n i_Diff, FA= T_FA/T_mot,
 

    i_tot, RA= i_gear i_Diff, FA=n_mot/n i_Diff, RA= T_RA/T_mot,


respectively. Thus, the longitudinal forces are   


    F_∥, FA=T_mot  i_tot, FA/r_dyn,
 

    F_∥, RA=T_mot  i_tot, RA/r_dyn,
 

respectively.
If dedicated engines for the front and rear axle are used instead,


    F_∥, FA=T_mot, FA i_FA/r_dyn,
 

    F_∥, RA=T_mot, RA i_RA/r_dyn,
 

respectively.

 elsarticle-num-names
43
natexlab#1#1









[#1],#1

[Koren et al.(2015)Koren, Shpitalni, Gu, and Hu]KOREN201564
authorY. Koren, authorM. Shpitalni,
  authorP. Gu, authorS. Hu,
titleProduct design for mass-individualization,
journalProcedia CIRP volume36
  (year2015) pages64 – 71. <http://www.sciencedirect.com/science/article/pii/S2212827115002486>.
  https://doi.org/10.1016/j.procir.2015.03.050,
  notecIRP 25th Design Conference Innovative Product Creation.

[ISO(2018)]iso26262_2nd
authorInternational Organization for Standardization, titleISO 26262:2018 Road vehicles – Functional
  safety, year2018.

[Koppel et al.(2008)Koppel, Charlton, Fildes, and
  Fitzharris]KOPPEL2008994
authorS. Koppel, authorJ. Charlton,
  authorB. Fildes, authorM. Fitzharris,
titleHow important is vehicle safety in the new vehicle
  purchase process?,
journalAccident Analysis & Prevention
  volume40 (year2008) pages994 – 1004.
  <http://www.sciencedirect.com/science/article/pii/S0001457507002023>.
  https://doi.org/10.1016/j.aap.2007.11.006.

[Shaaban et al.(2019)Shaaban, Maher, and Singhapakdi]SHAABAN2019493
authorK. Shaaban, authorA. Maher,
  authorA. Singhapakdi,
titleEffect of vehicle safety recalls on the perception
  towards other vehicles from the same country of origin,
journalJournal of Traffic and Transportation Engineering
  (English Edition) volume6 (year2019)
  pages493 – 503. <http://www.sciencedirect.com/science/article/pii/S2095756418300588>.
  https://doi.org/10.1016/j.jtte.2018.09.006.

[Forsberg and Mooz(1991)]Forsberg1991
authorK. Forsberg, authorH. Mooz,
titleThe relationship of system engineering to the project
  cycle,
journalINCOSE International Symposium volume1
  (year1991) pages57–65. <https://onlinelibrary.wiley.com/doi/abs/10.1002/j.2334-5837.1991.tb01484.x>.
  10.1002/j.2334-5837.1991.tb01484.x.

[Luo and van den Brand(2016)]LUO2016151
authorY. Luo, authorM. van den Brand,
titleMetrics design for safety assessment,
journalInformation and Software Technology
  volume73 (year2016) pages151 – 163.
  <http://www.sciencedirect.com/science/article/pii/S0950584915002219>.
  https://doi.org/10.1016/j.infsof.2015.12.012.

[ISO(2011)]iso26262_1st
authorInternational Organization for Standardization, titleISO 26262:2011 Road vehicles – Functional
  safety, year2011.

[Debouk(2018)]debouk2018
authorR. Debouk, titleOverview of the 2nd Edition of ISO
  26262: Functional Safety-Road Vehicles, typeTechnical Report,
  General Motors Research & Development, year2018.
  10.13140/RG.2.2.10077.26085.

[Kafka(2012)]KAFKA20122
authorP. Kafka,
titleThe automotive standard iso 26262, the innovative
  driver for enhanced safety assessment & technology for motor cars,
journalProcedia Engineering volume45
  (year2012) pages2 – 10. <http://www.sciencedirect.com/science/article/pii/S1877705812031244>.
  10.1016/j.proeng.2012.08.112,
  note2012 International Symposium on Safety Science and
  Technology.

[Graf et al.(2015)Graf, Glaß, Teich, and Platte]Graf2015
authorS. Graf, authorM. Glaß,
  authorJ. Teich, authorD. Platte,
titleA methodology for the optimized design of an E/E
  architecture component platform,
in: editorM. Bargende, editorH.-C. Reuss,
  editorJ. Wiedemann (Eds.), booktitle15.
  Internationales Stuttgarter Symposium, publisherSpringer
  Fachmedien Wiesbaden, addressWiesbaden, year2015,
  pp. pages203–215.

[Drabble(2009)]Drabble2009
authorS. Drabble,
titleSafety process measurement - are we there yet?,
in: editorC. Dale, editorT. Anderson (Eds.),
  booktitleSafety-Critical Systems: Problems, Process and Practice,
  publisherSpringer London, addressLondon,
  year2009, pp. pages195–207.

[Yoe(2019)]Yoe2019
authorC. E. Yoe, titlePrinciples of risk analysis:
  decision making under uncertainty, editionsecond edition ed.,
  publisherCRC Press, year2019.
  10.1201/9780429021121.

[Carlson(2001)]Carlson2001
authorL. Eriksson,
authorE. Johansson,
authorN. Kettaneh-Wold,
authorC. Wikström,
authorS. Wold,
titleDesign of experiments, principles and applications
publisherUmetrics AB,
year2001

[Jeff and Hamada(2009)]C.F.JeffWu2009
authorW. C. F. Jeff, authorM. S. Hamada,
  titleExperiments: Planning, Analysis, and Optimization,
  edition2nd edition ed., publisherWiley,
  year2009.

[IEC(2007)]IEC62366:2007
titleIEC 62366:2007 medical devices - application of usability
  engineering to medical devices, year2007. <https://www.iso.org/standard/38594.html>.

[Loring(2018)]Loring2018
authorB. Loring, titleWorst-case scenarios for usability
  testing, year2018. <https://www.loring-hf.com/single-post/2018/10/16/Worst-Case-Scenarios-for-Usability-Testing>.

[Gardner et al.(1998)Gardner, Smith, Gerber, and
  Zabriskie]Gardner1998
authorA. R. Gardner, authorT. M. Smith,
  authorR. G. Gerber, authorD. W. Zabriskie,
  titleWorst-Case Approach To Validation of Operating Ranges,
  year1998, pp. pages69–79. <https://pubs.acs.org/doi/abs/10.1021/bk-1998-0698.ch006>.
  10.1021/bk-1998-0698.ch006.

[Fitzpatrick(2018)]Fitzpatrick2018
authorD. Fitzpatrick,
titleChapter 11 - worst case analysis,
in: editorD. Fitzpatrick (Ed.),
  booktitleAnalog Design and Simulation Using OrCAD Capture and
  PSpice (Second Edition), editionsecond edition ed.,
  publisherNewnes, year2018, pp. pages165 –
  175. <http://www.sciencedirect.com/science/article/pii/B9780081025055000112>.
  10.1016/B978-0-08-102505-5.00011-2.

[Ericson(2005)]CliftonA.Ericson2005
authorC. A. I. Ericson, titleHazard Analysis Techniques
  for System Safety, editionsecond edition ed.,
  publisherJohn Wiley & Sons, Inc., year2005.
  <https://onlinelibrary.wiley.com/doi/book/10.1002/0471739421>.
  10.1002/0471739421.

[Khastgir et al.(2017)Khastgir, Birrell, Dhadyalla, Sivencrona, and
  Jennings]KHASTGIR2017166
authorS. Khastgir, authorS. Birrell,
  authorG. Dhadyalla, authorH. Sivencrona,
  authorP. Jennings,
titleTowards increased reliability by objectification of
  hazard analysis and risk assessment (hara) of automated automotive systems,
journalSafety Science volume99
  (year2017) pages166 – 177. <http://www.sciencedirect.com/science/article/pii/S0925753517305763>.
  10.1016/j.ssci.2017.03.024.

[Baker et al.(1974)Baker, O'Neill, Haddon, and Long]BAKER1974
authorS. P. Baker, authorB. O'Neill,
  authorW. J. Haddon, authorW. B. Long,
titleThe injury severity score: A method for describing
  patients with multiple injuries and evaluating emergency care,
journalJournal of Trauma and Acute Care Surgery
  volume14 (year1974) pages187–196.
  
  

[INTERNATIONAL ELECTROTECHNICAL COMMISSION(2010)]IEC61508-2nd
authorINTERNATIONAL ELECTROTECHNICAL COMMISSION,
  titleFunctional safety of electrical/electronic/programmable
  electronic safety-related systems IEC 61508 2nd edition,
  year2010.

[of the SAE International(2018)]SAEInternational2018
authorF. S. C. of the SAE International,
  titleConsiderations for ISO 26262 ASIL hazard classification,
  year2018. <https://www.sae.org/standards/content/j2980_201804/>.
  10.4271/J2980_201804.

[Sit(2015)]Sitkat-2015
titleSituationskatalog E-Parameter nach ISO 26262-3,
  typeTechnical Report numberVDA 702, VERBAND DER
  AUTOMOBILINDUSTRIE E. V. (VDA), addressBehrenstr. 35; 10117
  Berlin; Germany, year2015.

[Rosén et al.(2011)Rosén, Stigson, and Sander]ROSEN201125
authorE. Rosén, authorH. Stigson,
  authorU. Sander,
titleLiterature review of pedestrian fatality risk as a
  function of car impact speed,
journalAccident Analysis & Prevention
  volume43 (year2011) pages25 – 33.
  <http://www.sciencedirect.com/science/article/pii/S0001457510001077>.
  10.1016/j.aap.2010.04.003.

[Schaap et al.(2008)Schaap, van Arem, and van der
  Horst]Schaap2008
authorN. Schaap, authorB. van Arem,
  authorA. van der Horst,
titleDrivers' behavioural reactions to unexpected events.
  influence of workload, environment and driver characteristics,
in: editorH. van Zuylen, editorA. van
  Binsbergen (Eds.), booktitleTRAIL in Perspective, Selected
  Papers 10th International TRAIL Congres, publisherTRAIL Research
  School (TUD), year2008, pp. pages213–231.

[Young and Stanton(2007)]Young2007
authorM. S. Young, authorN. A. Stanton,
titleBack to the future: Brake reaction times for manual
  and automated vehicles,
journalErgonomics volume50
  (year2007) pages46–58. 
  10.1080/00140130600980789.arXiv:https://doi.org/10.1080/00140130600980789.

[Ergai et al.(2016)Ergai, Cohen, Sharp, Wiegmann, Gramopadhye, and
  Shappell]ERGAI2016393
authorA. Ergai, authorT. Cohen,
  authorJ. Sharp, authorD. Wiegmann,
  authorA. Gramopadhye, authorS. Shappell,
titleAssessment of the human factors analysis and
  classification system (hfacs): Intra-rater and inter-rater reliability,
journalSafety Science volume82
  (year2016) pages393 – 398. <http://www.sciencedirect.com/science/article/pii/S092575351500257X>.
  10.1016/j.ssci.2015.09.028.

[Johansson and Nilsson(2016)]Johansson2016
authorR. Johansson, authorJ. Nilsson,
titleThe need for an environment perception block to
  address all ASIL levels simultaneously,
in: booktitle2016 IEEE Intelligent Vehicles Symposium
  (IV), year2016, pp. pages1–4.
  10.1109/IVS.2016.7535354.

[McGehee et al.(2000)McGehee, Mazzae, and Baldwin]McGehee2000
authorD. V. McGehee, authorE. N. Mazzae,
  authorG. S. Baldwin,
titleDriver reaction time in crash avoidance research:
  Validation of a driving simulator study on a test track,
journalProceedings of the Human Factors and Ergonomics
  Society Annual Meeting volume44 (year2000)
  pages3–320–3–323. 10.1177/154193120004402026.

[for Devices and Health(2016)]FDA2016
authorC. for Devices, authorR. Health,
  titleApplying Human Factors and Usability Engineering to Medical
  Devices, organizationU.S. Food and Drug Administration,
  year2016. <https://www.fda.gov/regulatory-information/search-fda-guidance-documents/
	applying-human-factors-and-usability-engineering-medical-devices>.

[Rinnooy Kan and Timmer(1987)]RinnooyKan1987
authorA. Rinnooy Kan, authorG. Timmer,
titleStochastic global optimization methods part i:
  Clustering methods.,
journalMathematical Programming volume39
  (year1987). 10.1007/BF02592070.

[Moles et al.(2003)Moles, Mendes, and JR.]Moles2003
authorC. Moles, authorP. Mendes,
  authorB. JR.,
titleParameter estimation in biochemical pathways: a
  comparison of global optimization methods.,
journalGenome Res. volume13
  (year2003) pages2467–74.

[Jones et al.(1998)Jones, Schonlau, and Welch]Jones1998
authorD. R. Jones, authorM. Schonlau,
  authorW. J. Welch,
titleEfficient global optimization of expensive black-box
  functions,
journalJournal of Global Optimization
  (year1998) pages455–492.
  10.1023/A:1008306431147.

[Neal(1997)]neal1997monte
authorR. M. Neal, titleMonte Carlo implementation of
  Gaussian process models for Bayesian regression and classification,
  year1997. http://arxiv.org/abs/physics/9701026arXiv:physics/9701026.

[Josef Winter(2017)]Josef2017
authorJosef Winter,
authorFelix Schranner,
authorN. A. Adams,
titleIterative Bayesian optimization of an implicit LES
  method for under-resolved simulations of incompressible flows,
in: booktitle10th International Symposium on Turbulence
  and Shear Flow Phenomena, year2017. <http://www.tsfp-conference.org/proceedings/2017/2/207.pdf>.

[Schranner et al.(2016)Schranner, Rozov, and Adams]Schranner2016
authorF. S. Schranner, authorV. Rozov,
  authorN. A. Adams,
titleOptimization of an implicit large-eddy simulation
  method for underresolved incompressible flow simulations,
journalAIAA Journal volume54
  (year2016) pages1567–1577. <10.2514/1.J054741>. 10.2514/1.J054741.
  http://arxiv.org/abs/https://doi.org/10.2514/1.J054741arXiv:https://doi.org/10.2514/1.J054741.

[Richter(2016)]Richter2016
authorT. Richter, titlePlanung von Autobahnen und
  Landstraßen, publisherSpringer Vieweg,
  addressWiesbaden, year2016.
  10.1007/978-3-658-13009-1.

[Schramm et al.(2014)Schramm, Hiller, and Bardini]Schramm2014
authorD. Schramm, authorM. Hiller,
  authorR. Bardini, titleVehicle Dynamics,
  publisherSpringer-Verlag Berlin Heidelberg, year2014.
  10.1007/978-3-540-36045-2.

[Rajamani(2012)]Rajamani2012
authorR. Rajamani, titleVehicle Dynamics and Control,
  Mechanical Engineering Ser.ies, editionsecond edition ed.,
  publisherSpringer, year2012.

[Riekert and Schunck(1940)]Riekert1940
authorP. Riekert, authorT. E. Schunck,
titleZur Fahrmechanik des gummibereiften
  Kraftfahrzeugs,
journalIngenieur Archiv volume11
  (year1940).

[Breuer and Rohrbach-Kerl(2015)]Breuer2015
authorS. Breuer, authorA. Rohrbach-Kerl,
  titleFahrzeugdynamik, publisherSpringer Fachmedien,
  addressWiesbaden, year2015.
  10.1007/978-3-658-09475-1.

[Car(2017)]CarSimNotes2018
titleCarSim 2018.0 Release Notes, organizationMechanical
  Simulation, address755 Phoenix Drive, Ann Arbor MI, 48108, USA,
  year2017. <https://www.carsim.com/users/pdf/release_notes/carsim/CarSim2018_New_Features.pdf>.


tocchapterBibliography
