ERA's EMC and Safety Engineering group has recently completed an independent safety assessment of the Electronic Accelerator Control (EAC) fitted to new versions of the Ford Focus, including the Focus C-Max. Following on from a similar project carried out during the Ford Fiesta update, Ford Motor Company commissioned ERA to ensure that appropriate technical and process measures had been taken to ensure the safety and reliability of the EAC function.

EAC provides optimisation of engine performance and fuel efficiency. It is implemented by the vehicle's engine management system, which incorporates novel safety monitoring and control features, designed to ensure safe vehicle behaviour. A range of different Focus engine specifications is available, with engine management systems supplied by three different suppliers.

In the absence of an international or European sector-specific functional safety
standard for automotive electronics, appropriate safety assessment criteria had to be
established. As a starting point, the requirements of the generic functional safety
standard, IEC 61508, and the Motor Industry Software Reliability Association's software development guidelines were used. These requirements and guidelines were interpreted by ERA and tailored to match the context of the automotive electronics industry, and of the three engine management system suppliers in particular.
ERA's strategy in conducting the assessment revolved around the following stepped
approach:

ensuring that a thorough analysis of the EAC function had been carried out and appropriate safety management mechanisms were correctly identified ensuring that the results of this analysis were correctly captured in the requirements specification issued by Ford to the engine management system suppliers ensuring that the specified requirements had been implemented by all system suppliers and that the system hardware and software development
processes employed matched the required integrity of the EAC function ensuring that sufficiently rigorous validation testing of the system, once integrated in the vehicle, had been conducted.

This strategy was formalised at the start of the project with the issue of an Independent Safety Assessment Plan, outlining a defined set of assessment tasks and corresponding assessment criteria applicable to each task. ERA worked closely with Ford's own functional safety assurance team and the engine management system suppliers to complete the project. The final assessment was completed, with satisfactory answers to all questions arising during the assessment tasks, within the agreed timescales of the vehicle development programme. The final outcome of the assessment was that ERA was able to recommend to Ford's management that there was sufficient evidence that the systems implementing the EAC function were fit-for-purpose and could be released for production.

For further information contact: safetyengineering@era.co.uk